download:

test.mp3

Full analysis: https://app.any.run/tasks/a7d12838-d9ce-4c8f-a243-784497429d89
Verdict: Malicious activity
Analysis date: August 11, 2019, 05:31:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: audio/mpeg
File info: Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, Stereo
MD5:

B19F78947663286401F2A384C2FE714F

SHA1:

889B6497B28E2E0A819097186F0C855D88A3A0B4

SHA256:

91F8549D5321D999E18430ED632712EF61643C118448FF59DC510B057CF2DB71

SSDEEP:

49152:K1McFPoLOyXqnaq5w1yFRdUtug9HdrVr6F2MdfM0n7Y2sutfZmlDtUNG0V:K6coLOyXqQmRdUtuqVmpfM07Y2s+0Vqx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • DllHost.exe (PID: 2344)

  • SUSPICIOUS

    • Creates files in the user directory

      • vlc.exe (PID: 3128)

    • Executed via COM

      • DllHost.exe (PID: 3232)
      • DllHost.exe (PID: 2344)

  • INFO

    • Manual execution by user

      • UserAccountControlSettings.exe (PID: 2984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.mp3 | LAME encoded MP3 audio (ID3 v2.x tag) (62.5)
.mp3 | MP3 audio (ID3 v2.x tag) (37.5)

EXIF

MPEG

MPEGAudioVersion: 1
AudioLayer: 3
AudioBitrate: 128 kbps
SampleRate: 44100
ChannelMode: Stereo
MSStereo: Off
IntensityStereo: Off
CopyrightFlag: -
OriginalMedia: -
Emphasis: None

ID3

UserDefinedText: (compatible_brands) iso6mp41
EncoderSettings: Lavf58.19.102

Composite

Duration: 0:02:57 (approx)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
5
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start vlc.exe useraccountcontrolsettings.exe no specs %systemroot%\System32\UserAccountControlSettings.dll no specs %systemroot%\System32\UserAccountControlSettings.dll no specs useraccountcontrolsettings.exe

Process information

PID
CMD
Path
Indicators
Parent process
2344C:\Windows\system32\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2984"C:\Windows\system32\UserAccountControlSettings.exe" C:\Windows\system32\UserAccountControlSettings.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
UserAccountControlSettings
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\useraccountcontrolsettings.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3080"C:\Windows\system32\UserAccountControlSettings.exe" /applySettingsC:\Windows\system32\UserAccountControlSettings.exe
DllHost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
UserAccountControlSettings
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\useraccountcontrolsettings.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3128"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\admin\AppData\Local\Temp\test.mp3"C:\Program Files\VideoLAN\VLC\vlc.exe
explorer.exe
User:
admin
Company:
VideoLAN
Integrity Level:
MEDIUM
Description:
VLC media player
Exit code:
0
Version:
2.2.6
Modules
Images
c:\program files\videolan\vlc\vlc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\videolan\vlc\libvlc.dll
c:\program files\videolan\vlc\libvlccore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3232C:\Windows\system32\DllHost.exe /Processid:{06C792F8-6212-4F39-BF70-E8C0AC965C23}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
397
Read events
390
Write events
7
Delete events
0

Modification events

(PID) Process:(3232) DllHost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3232) DllHost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2344) DllHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
1
(PID) Process:(2344) DllHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:ConsentPromptBehaviorAdmin
Value:
5
(PID) Process:(2344) DllHost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:PromptOnSecureDesktop
Value:
0
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3128vlc.exeC:\Users\admin\AppData\Local\Temp\VLCED66.tmp —
MD5:—
SHA256:—
3128vlc.exeC:\Users\admin\AppData\Local\Temp\VLCEE71.tmp —
MD5:—
SHA256:—
3128vlc.exeC:\Users\admin\AppData\Local\Temp\VLCEE72.tmp —
MD5:—
SHA256:—
3128vlc.exeC:\Users\admin\AppData\Local\Temp\VLCEE73.tmp —
MD5:—
SHA256:—
3128vlc.exeC:\Users\admin\AppData\Local\Temp\VLCEE74.tmp —
MD5:—
SHA256:—
3128vlc.exeC:\Users\admin\AppData\Local\Temp\VLCEE85.tmp —
MD5:—
SHA256:—
3128vlc.exeC:\Users\admin\AppData\Local\Temp\VLCEE86.tmp —
MD5:—
SHA256:—
3128vlc.exeC:\Users\admin\AppData\Local\Temp\VLCEE87.tmp —
MD5:—
SHA256:—
3128vlc.exeC:\Users\admin\AppData\Local\Temp\VLCEE88.tmp —
MD5:—
SHA256:—
3128vlc.exeC:\Users\admin\AppData\Local\Temp\VLCEEE6.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
vlc.exe
core libvlc: one instance mode ENABLED
vlc.exe
core libvlc: Running vlc with the default interface. Use 'cvlc' to use vlc without interface.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
test.mp3