Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-06-2024 04:58
Static task
static1
Behavioral task
behavioral1
Sample
bus.wav
Resource
win7-20231129-en
General
-
Target
bus.wav
-
Size
21.6MB
-
MD5
e0f47a26ec369970094ee98e3c987e18
-
SHA1
699b7d42da4435f92aaa4270edd5ac3e89248635
-
SHA256
516f60793ed593751f3f8bef379430e7f19682985dc798a7535c2bbc412399de
-
SHA512
5660babc5bfbe91cdecd6403353b997abf5ee3e1e57933283436954532f39125d396467adf8cc084f443c24b5bf47792522e3df6fc7bd634f0447cd6e998b129
-
SSDEEP
393216:x8dNr8r9VJgVgkz0VAlkTGueYLLHl+CW1bW7V4+l8X+vZw6gvJcCHXGdMg0EQ:xE2VkgNAqTVLLHYCW1be428X+vP6JxHB
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2028 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 2028 vlc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vlc.exedescription pid process Token: 33 2028 vlc.exe Token: SeIncBasePriorityPrivilege 2028 vlc.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
vlc.exepid process 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
vlc.exepid process 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe 2028 vlc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 2028 vlc.exe
Processes
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\bus.wav"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2028-6-0x000007FEFA810000-0x000007FEFA844000-memory.dmpFilesize
208KB
-
memory/2028-5-0x000000013F3C0000-0x000000013F4B8000-memory.dmpFilesize
992KB
-
memory/2028-8-0x000007FEFB4D0000-0x000007FEFB4E8000-memory.dmpFilesize
96KB
-
memory/2028-13-0x000007FEF76A0000-0x000007FEF76BD000-memory.dmpFilesize
116KB
-
memory/2028-12-0x000007FEF76C0000-0x000007FEF76D1000-memory.dmpFilesize
68KB
-
memory/2028-11-0x000007FEF76E0000-0x000007FEF76F7000-memory.dmpFilesize
92KB
-
memory/2028-7-0x000007FEF5EB0000-0x000007FEF6164000-memory.dmpFilesize
2.7MB
-
memory/2028-10-0x000007FEF7780000-0x000007FEF7791000-memory.dmpFilesize
68KB
-
memory/2028-9-0x000007FEFAF50000-0x000007FEFAF67000-memory.dmpFilesize
92KB
-
memory/2028-16-0x000007FEF70F0000-0x000007FEF712F000-memory.dmpFilesize
252KB
-
memory/2028-18-0x000007FEF70A0000-0x000007FEF70B8000-memory.dmpFilesize
96KB
-
memory/2028-14-0x000007FEF5CB0000-0x000007FEF5EB0000-memory.dmpFilesize
2.0MB
-
memory/2028-21-0x000007FEF6A80000-0x000007FEF6A91000-memory.dmpFilesize
68KB
-
memory/2028-20-0x000007FEF6AA0000-0x000007FEF6AB1000-memory.dmpFilesize
68KB
-
memory/2028-22-0x000007FEF6A60000-0x000007FEF6A7B000-memory.dmpFilesize
108KB
-
memory/2028-23-0x000007FEF6660000-0x000007FEF6671000-memory.dmpFilesize
68KB
-
memory/2028-25-0x000007FEF6610000-0x000007FEF6640000-memory.dmpFilesize
192KB
-
memory/2028-26-0x000007FEF65A0000-0x000007FEF6607000-memory.dmpFilesize
412KB
-
memory/2028-24-0x000007FEF6640000-0x000007FEF6658000-memory.dmpFilesize
96KB
-
memory/2028-19-0x000007FEF6AC0000-0x000007FEF6AD1000-memory.dmpFilesize
68KB
-
memory/2028-17-0x000007FEF70C0000-0x000007FEF70E1000-memory.dmpFilesize
132KB
-
memory/2028-15-0x000007FEF7680000-0x000007FEF7691000-memory.dmpFilesize
68KB
-
memory/2028-30-0x000007FEF4BA0000-0x000007FEF4BF6000-memory.dmpFilesize
344KB
-
memory/2028-34-0x000007FEF4B20000-0x000007FEF4B43000-memory.dmpFilesize
140KB
-
memory/2028-41-0x000007FEF4860000-0x000007FEF4875000-memory.dmpFilesize
84KB
-
memory/2028-44-0x000007FEF47E0000-0x000007FEF47F2000-memory.dmpFilesize
72KB
-
memory/2028-43-0x000007FEF4800000-0x000007FEF4812000-memory.dmpFilesize
72KB
-
memory/2028-51-0x000007FEF45A0000-0x000007FEF45B6000-memory.dmpFilesize
88KB
-
memory/2028-50-0x000007FEF45C0000-0x000007FEF45D1000-memory.dmpFilesize
68KB
-
memory/2028-27-0x000007FEF4C00000-0x000007FEF5CAB000-memory.dmpFilesize
16.7MB
-
memory/2028-49-0x000007FEF45E0000-0x000007FEF45F1000-memory.dmpFilesize
68KB
-
memory/2028-48-0x000007FEF4600000-0x000007FEF4611000-memory.dmpFilesize
68KB
-
memory/2028-47-0x000007FEF4620000-0x000007FEF4634000-memory.dmpFilesize
80KB
-
memory/2028-46-0x000007FEF4640000-0x000007FEF4653000-memory.dmpFilesize
76KB
-
memory/2028-45-0x000007FEF4660000-0x000007FEF47DA000-memory.dmpFilesize
1.5MB
-
memory/2028-42-0x000007FEF4820000-0x000007FEF4831000-memory.dmpFilesize
68KB
-
memory/2028-40-0x000007FEF4880000-0x000007FEF4896000-memory.dmpFilesize
88KB
-
memory/2028-39-0x000007FEF48A0000-0x000007FEF48B1000-memory.dmpFilesize
68KB
-
memory/2028-38-0x000007FEF48C0000-0x000007FEF48EF000-memory.dmpFilesize
188KB
-
memory/2028-37-0x000007FEFAFA0000-0x000007FEFAFB0000-memory.dmpFilesize
64KB
-
memory/2028-36-0x000007FEF4AE0000-0x000007FEF4AF2000-memory.dmpFilesize
72KB
-
memory/2028-35-0x000007FEF4B00000-0x000007FEF4B11000-memory.dmpFilesize
68KB
-
memory/2028-33-0x000007FEF4B50000-0x000007FEF4B67000-memory.dmpFilesize
92KB
-
memory/2028-32-0x000007FEF4B70000-0x000007FEF4B94000-memory.dmpFilesize
144KB
-
memory/2028-31-0x000007FEF64E0000-0x000007FEF6508000-memory.dmpFilesize
160KB
-
memory/2028-29-0x000007FEF6510000-0x000007FEF6521000-memory.dmpFilesize
68KB
-
memory/2028-28-0x000007FEF6530000-0x000007FEF659F000-memory.dmpFilesize
444KB
-
memory/2028-54-0x000007FEF5EB0000-0x000007FEF6164000-memory.dmpFilesize
2.7MB