9ed5767db68fb669b3f18a0565cae471ee3800b94a187c4512e5a6691797c511

Resubmissions

27/11/2024, 20:39

241127-zfpdtszjes 6

27/11/2024, 20:33

25/11/2024, 22:14

25/11/2024, 20:57

28/09/2024, 18:21

Analysis

max time kernel
110s
max time network
130s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
25/11/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sounds/2.wav
Size

377KB
MD5

4408f456a35c301ee1b951e20ffa71bb
SHA1

63604caf85ad088dd066028e52ed4a2543da76c8
SHA256

7fa9cf8acd084895cd9841386df059a29897b7cac9d52cc5e1df16e6a9162549
SHA512

8a963ecd50eb26f630ebda32dec2206b1412651b6574cd55596fa3e5b5d84ab9c166a1db26639b61f0c5613ffa50e07c1c609bf0f57a1de0f59a3395b5a42c5d
SSDEEP

6144:sqAsjVIwo4gpm6dSg3x6R2Bc1/nxg4h46dBTu+2JRwg0hkdeFEEJ:5nVIwobF34Rcc9nxgk4qswBhkdeFEE

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2468	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2468	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	4536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4536	AUDIODG.EXE
Token: 33	2468	vlc.exe
Token: SeIncBasePriorityPrivilege	2468	vlc.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe
2468	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2468	vlc.exe

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\sounds\2.wav"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x514 0x500
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-5-0x00007FF734DC0000-0x00007FF734EB8000-memory.dmp

Filesize
992KB

Download
memory/2468-6-0x00007FFBC87E0000-0x00007FFBC8814000-memory.dmp

Filesize
208KB

Download
memory/2468-11-0x00007FFBC9300000-0x00007FFBC9317000-memory.dmp

Filesize
92KB

Download
memory/2468-14-0x00007FFBC8650000-0x00007FFBC8661000-memory.dmp

Filesize
68KB

Download
memory/2468-13-0x00007FFBC8670000-0x00007FFBC868D000-memory.dmp

Filesize
116KB

Download
memory/2468-12-0x00007FFBC8690000-0x00007FFBC86A1000-memory.dmp

Filesize
68KB

Download
memory/2468-7-0x00007FFBC7910000-0x00007FFBC7BC6000-memory.dmp

Filesize
2.7MB

Download
memory/2468-9-0x00007FFBCEF00000-0x00007FFBCEF17000-memory.dmp

Filesize
92KB

Download
memory/2468-8-0x00007FFBCF390000-0x00007FFBCF3A8000-memory.dmp

Filesize
96KB

Download
memory/2468-10-0x00007FFBCAB20000-0x00007FFBCAB31000-memory.dmp

Filesize
68KB

Download
memory/2468-15-0x00007FFBB9270000-0x00007FFBB947B000-memory.dmp

Filesize
2.0MB

Download
memory/2468-19-0x00007FFBC8500000-0x00007FFBC8518000-memory.dmp

Filesize
96KB

Download
memory/2468-22-0x00007FFBC8420000-0x00007FFBC8431000-memory.dmp

Filesize
68KB

Download
memory/2468-21-0x00007FFBC84C0000-0x00007FFBC84D1000-memory.dmp

Filesize
68KB

Download
memory/2468-20-0x00007FFBC84E0000-0x00007FFBC84F1000-memory.dmp

Filesize
68KB

Download
memory/2468-18-0x00007FFBC8620000-0x00007FFBC8641000-memory.dmp

Filesize
132KB

Download
memory/2468-17-0x00007FFBC8520000-0x00007FFBC8561000-memory.dmp

Filesize
260KB

Download
memory/2468-16-0x00007FFBB81C0000-0x00007FFBB9270000-memory.dmp

Filesize
16.7MB

Download