Analysis
-
max time kernel
30s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 11:53
Static task
static1
Behavioral task
behavioral1
Sample
audio.mp3
Resource
win7-20240903-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
audio.mp3
Resource
win10v2004-20241007-en
8 signatures
150 seconds
General
-
Target
audio.mp3
-
Size
586KB
-
MD5
18cc509865fa6c0935ecd95665bc6a62
-
SHA1
9ba5ab2edbaad73d8622d8697065a93e83f4fba9
-
SHA256
8743d0ca21e63e8989031e976a8618e3454c9a9b62a097866953af3d1a605de5
-
SHA512
eb768f0320f370e14e2db25928a934d657c5acc260dcb37eef9a496918c99d1aafe9f18c8e197da53855f2cbe935842b41c0d9ea65c177149472dd12dd5b2731
-
SSDEEP
6144:NWNoi7BJfHaaOycCWPK6X6X1u0TsI++WwNeeeeeeeeeeeeeLd/rtjjjj63DrIlB:UP7jf6aOUWKu0kwAhtjjjj63Dre
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2644 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2644 vlc.exe 1204 SndVol.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2644 vlc.exe Token: SeIncBasePriorityPrivilege 2644 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2644 vlc.exe 2644 vlc.exe 2644 vlc.exe 2644 vlc.exe 2644 vlc.exe 2644 vlc.exe 1204 SndVol.exe 1204 SndVol.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 2644 vlc.exe 2644 vlc.exe 2644 vlc.exe 2644 vlc.exe 2644 vlc.exe 1204 SndVol.exe 1204 SndVol.exe 1204 SndVol.exe 1204 SndVol.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2644 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\audio.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2644
-
C:\Windows\system32\SndVol.exeSndVol.exe -f 45941911 134551⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1204