Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
23s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/01/2025, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
bewm.mov
Resource
win7-20241010-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
bewm.mov
Resource
win10v2004-20241007-en
8 signatures
150 seconds
General
-
Target
bewm.mov
-
Size
766KB
-
MD5
2fe7334666b7da49de744e0f83f6b237
-
SHA1
e0376277c4e788a6e51e20f78e27275a37af2b2b
-
SHA256
b98f6794703b2327b9b72011950d8831b0323fc959c5ee5b8a31b90eea007334
-
SHA512
deb8d4a66a82cf5bf9827ba76911d7cbbc0d5f44905ed137a2b558c30c2279a6a83f50f05b3e4fca957e557a5a02482fb9dd905ec10a06cbcc90af7c831c80e3
-
SSDEEP
12288:HoQyN1mkXViCdZIKB1NSskgKycJse+UYnpcJHUzRc0DVrHL8i0zvtKX79/J8EB:HoQyrmkF7ZloXwcJszUYKUVBrHprkEB
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2220 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2220 vlc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: 33 2264 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2264 AUDIODG.EXE Token: 33 2264 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2264 AUDIODG.EXE Token: 33 2220 vlc.exe Token: SeIncBasePriorityPrivilege 2220 vlc.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
pid Process 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe 2220 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2220 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\bewm.mov"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2220
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4581⤵
- Suspicious use of AdjustPrivilegeToken
PID:2264