Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
lighthouse_teslacrypt_ransomware.mp4
Resource
win7-20240729-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
lighthouse_teslacrypt_ransomware.mp4
Resource
win10v2004-20241007-en
8 signatures
150 seconds
General
-
Target
lighthouse_teslacrypt_ransomware.mp4
-
Size
3.1MB
-
MD5
577c4a77455c945bf638349a16aa9b47
-
SHA1
ff9139369ebf187e64c86348132dfb5f20bd4ac9
-
SHA256
c7503cdbc638d4886e9b06942b9afc345f041663734963b49fb25e1577287c46
-
SHA512
64a5510ca8c19915c9a88a524ca12731d2cb7b672d84f9db58c0aac7e39e1d89cf50981078dbcb905fd75f259124b9aee055e2d6fc95387023345c770313283c
-
SSDEEP
49152:pHZUdEm4AOcOgifdrIstug5mBdNUQIAfe3o7DDeh+HAjADJEsgBUEG5o5OpaRWC3:pHZA74A9UfOCmHIRoDeCJDGVBvG5o5O0
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1884 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1884 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1884 vlc.exe Token: SeIncBasePriorityPrivilege 1884 vlc.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe 1884 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1884 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\lighthouse_teslacrypt_ransomware.mp4"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1884