9ed5767db68fb669b3f18a0565cae471ee3800b94a187c4512e5a6691797c511

Resubmissions

27-11-2024 20:39

241127-zfpdtszjes 6

27-11-2024 20:33

25-11-2024 22:14

25-11-2024 20:57

28-09-2024 18:21

Analysis

max time kernel
110s
max time network
100s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
25-11-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sounds/3.wav
Size

126KB
MD5

9ca4aec9ef66806361f3e0ae86792c86
SHA1

671294b6aa687913fd80e1e87d95ceb73a5ec3d6
SHA256

a84110a22bb431b785dc931790efbde81c012f5fa1f44e822e85093366c13cae
SHA512

2983175b3c8a15728d9b6230f0d928091cad01596e647e1b1b8e9f2fa0ee9fbd4a511bbac028d9707f66592162af28a4bf19693174d982443755a999720259c1
SSDEEP

1536:KqlhFQcMSzneM2TTZpZ3UH7+l1epdlNr3e5XeeJfzw8gx48KEFRoMocwfz3Y64cb:Knc9zQl1Y3S5Xes7wXCuZocyz3p

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3364	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3364	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2816	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2816	AUDIODG.EXE
Token: 33	3364	vlc.exe
Token: SeIncBasePriorityPrivilege	3364	vlc.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe
3364	vlc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3364	vlc.exe

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\sounds\3.wav"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3364

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d4 0x2c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3364-6-0x00007FF836970000-0x00007FF8369A4000-memory.dmp

Filesize
208KB

Download
memory/3364-5-0x00007FF762900000-0x00007FF7629F8000-memory.dmp

Filesize
992KB

Download
memory/3364-14-0x00007FF835D30000-0x00007FF835D41000-memory.dmp

Filesize
68KB

Download
memory/3364-13-0x00007FF8362E0000-0x00007FF8362FD000-memory.dmp

Filesize
116KB

Download
memory/3364-7-0x00007FF8272F0000-0x00007FF8275A6000-memory.dmp

Filesize
2.7MB

Download
memory/3364-12-0x00007FF836300000-0x00007FF836311000-memory.dmp

Filesize
68KB

Download
memory/3364-11-0x00007FF836320000-0x00007FF836337000-memory.dmp

Filesize
92KB

Download
memory/3364-10-0x00007FF836340000-0x00007FF836351000-memory.dmp

Filesize
68KB

Download
memory/3364-9-0x00007FF836950000-0x00007FF836967000-memory.dmp

Filesize
92KB

Download
memory/3364-8-0x00007FF83E230000-0x00007FF83E248000-memory.dmp

Filesize
96KB

Download
memory/3364-15-0x00007FF8270E0000-0x00007FF8272EB000-memory.dmp

Filesize
2.0MB

Download
memory/3364-22-0x00007FF82D140000-0x00007FF82D151000-memory.dmp

Filesize
68KB

Download
memory/3364-21-0x00007FF82D750000-0x00007FF82D761000-memory.dmp

Filesize
68KB

Download
memory/3364-20-0x00007FF833F40000-0x00007FF833F51000-memory.dmp

Filesize
68KB

Download
memory/3364-19-0x00007FF833F60000-0x00007FF833F78000-memory.dmp

Filesize
96KB

Download
memory/3364-18-0x00007FF835C80000-0x00007FF835CA1000-memory.dmp

Filesize
132KB

Download
memory/3364-17-0x00007FF82D770000-0x00007FF82D7B1000-memory.dmp

Filesize
260KB

Download
memory/3364-16-0x00007FF826030000-0x00007FF8270E0000-memory.dmp

Filesize
16.7MB

Download
memory/3364-52-0x00007FF826030000-0x00007FF8270E0000-memory.dmp

Filesize
16.7MB

Download