402313e6b87dd3ef9e3b848b315bf3e6fdb3fe6671bdca38fcadfe8396536de7 | Triage

Resubmissions

24/10/2021, 13:48

211024-q39hvaebc4 8

26/08/2021, 13:23

210826-43nr8691ns 8

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-en-20211014
submitted
24/10/2021, 13:48

Sharing

Report Analysis Logs

General

Target

402313e6b87dd3ef9e3b848b315bf3e6fdb3fe6671bdca38fcadfe8396536de7.exe
Size

440KB
MD5

ee4fa8efb7477465a3f8a29a8e2a2e29
SHA1

6a0f698712161fae61dcbf811841b509b42cb08c
SHA256

402313e6b87dd3ef9e3b848b315bf3e6fdb3fe6671bdca38fcadfe8396536de7
SHA512

ba04e86752c235772325ae0ad1f8dba93b7fc536958d08f63de364c66268b1c93c63f210802d564cde2ead7cee5cef15ab4add0fbc0a7b57e9f1d8cdf72bddef

Score

6^/10

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2955169046-2371869340-1800780948-1000\desktop.ini	402313e6b87dd3ef9e3b848b315bf3e6fdb3fe6671bdca38fcadfe8396536de7.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1392	AUDIODG.EXE
Token: 33	1392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1392	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\402313e6b87dd3ef9e3b848b315bf3e6fdb3fe6671bdca38fcadfe8396536de7.exe
"C:\Users\Admin\AppData\Local\Temp\402313e6b87dd3ef9e3b848b315bf3e6fdb3fe6671bdca38fcadfe8396536de7.exe"
1⤵
- Drops desktop.ini file(s)
PID:1716

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1856

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x148
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-56-0x000007FEFB561000-0x000007FEFB563000-memory.dmp

Filesize
8KB

Download