Analysis
-
max time kernel
140s -
max time network
141s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
28/03/2025, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
audio.mp3
Resource
win10ltsc2021-20250314-en
6 signatures
150 seconds
General
-
Target
audio.mp3
-
Size
351KB
-
MD5
92eb070c086d1bb9b28fcba5ebbb33c3
-
SHA1
1c6d662f3b5a72605f2f6f61a866e97117e6f86a
-
SHA256
5cd36c5b77c6377ae703096c144caf9e0feb406da9716a7f1295787cfa7fd08f
-
SHA512
e1606c4bdd0b3f6da9616a23a0bb045ce63a8ae1a407e94cfe08e968e1842eeac3044d3486d74903b07055b074fd7704b48119b74cf4e0d97b863dc161e9d130
-
SSDEEP
6144:buw56SUx3RzoozAHUJyiQWntNrXUc6MC4WnSGGLj0dHoRJjBc+HdCfAOWoLSJg:bXIx3SUJyQsDMCFzG8dYBc+w5Z
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4260 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4260 vlc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 6060 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 6060 AUDIODG.EXE Token: 33 4260 vlc.exe Token: SeIncBasePriorityPrivilege 4260 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe 4260 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4260 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\audio.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4260
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4bc 0x4601⤵
- Suspicious use of AdjustPrivilegeToken
PID:6060