Resubmissions
01/12/2021, 22:56
211201-2ws33abgf4101/12/2021, 22:55
211201-2v518sgfdl101/12/2021, 22:53
211201-2t11wsbge6101/12/2021, 22:51
211201-2s416agfcm101/12/2021, 22:27
211201-2c978sbfb5101/12/2021, 22:27
211201-2c4qfsbfb2101/12/2021, 22:23
211201-2at38sbeh3430/11/2021, 22:48
211130-2q8xbsghbq130/11/2021, 22:46
211130-2p6qkscah5130/11/2021, 22:41
211130-2l6amscag61Analysis
- max time kernel
34s - max time network
135s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
01/12/2021, 22:56
Static task
static1
windows7_x64
0 signatures
0 seconds
windows10_x64
0 signatures
0 seconds
General
- Target [email protected]
- Size 31KB
- Sample211201-2ws33abgf4
- SHA256 4663715548c70eec7e9cbf272171493d47a75d2652e38cca870412ea9e749fe9
- MD5 c261c6e3332d0d515c910bbf3b93aab3
- SHA1 ff730b6b2726240df4b2f0db96c424c464c65c17
- SHA512 a93bd7b1d809493917e0999d4030cb53ab7789c65f6b87e1bbac27bd8b3ad2aeb92dec0a69369c04541f5572a78f04d8dfba900624cf5bd82d7558f24d0a8e26
- MD5 SHA1 SHA512
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1628 [email protected] Token: 33 960 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 960 AUDIODG.EXE Token: 33 960 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 960 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]"C:\Users\Admin\AppData\Local\Temp\[email protected]"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:572
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1e41⤵
- Suspicious use of AdjustPrivilegeToken
PID:960
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1912