Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-01-2025 20:58
Static task
static1
Behavioral task
behavioral1
Sample
youtube_gh9lfOdCjAA_audio (2) (4).mp3
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
youtube_gh9lfOdCjAA_audio (2) (4).mp3
Resource
win10v2004-20241007-en
asyncratgurcudefaultcollectioncredential_accessdiscoverypersistencephishingprivilege_escalationratspywarestealer
windows10-2004-x64
37 signatures
150 seconds
General
-
Target
youtube_gh9lfOdCjAA_audio (2) (4).mp3
-
Size
579KB
-
MD5
36e09440b78e3d3eb2030ab6afcb0e61
-
SHA1
b6fa8f88c98ef55cf5977643b313f27c954fd2ed
-
SHA256
a3c5117ed4b12ed1a1752fdc2cf01f7f10a5b305e77a1db0dde061c6df45477e
-
SHA512
dc65a17daa7a8064e8d529f03ee228b292e6a632536d5a34e286df0a7d470eace66cab24717398cf0c125bee2ea48aa29e746648e4c75a4f6113c52eea448872
-
SSDEEP
12288:OGgmVUJGKsaCMuKloXcmcExRH3FbezoJXK3eRsAr0c2PeJqDG3aydRbMv:O5oMDlGcmcExRH3FbeyXKOdpENqbU
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2168 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2168 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2168 vlc.exe Token: SeIncBasePriorityPrivilege 2168 vlc.exe -
Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe 2168 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2168 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\youtube_gh9lfOdCjAA_audio (2) (4).mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2168