b8b2f800c20f8fc42204b50f8bd173f0d706f874c5a3225dbd8240bb0b28750e | Triage

Resubmissions

15-09-2022 15:21

220915-srhxvshbdq 10

08-09-2022 18:20

220908-wysmesfca5 10

Analysis

max time kernel
45s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15-09-2022 15:21

Sharing

Report Analysis Logs

General

Target

out_jaf.dll
Size

1.3MB
MD5

7e7faedd77c84d1386093be29d262fc9
SHA1

e2ebba4f7eae6fb249a901ed10ef5672932fee87
SHA256

b8b2f800c20f8fc42204b50f8bd173f0d706f874c5a3225dbd8240bb0b28750e
SHA512

10eff3a123ac4efa416eb085f736c5c82fa8e5138676c36dc3875bbacd6d2b5c817e9da2b158bb10f631a4f63d4edca699d2c0e2d5ff8a0cd53160f6df571ea0
SSDEEP

24576:7gQw2TP5IRwHRwK2Lxsdlpr5+kHK9Zx/uqLIRMjI4i3v06HYtvk:v9IROyfGlpRHK9Zx/FaMjIVvQ

Score

5^/10

Malware Config

Signatures

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
1576	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1184	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1184	AUDIODG.EXE
Token: 33	1184	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1184	AUDIODG.EXE

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\out_jaf.dll,#1
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:1576

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1788

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-54-0x000007FEFBC61000-0x000007FEFBC63000-memory.dmp

Filesize
8KB

Download