a307816a648ad34876caeeee35aa76e616cc29bc177c84b2e07c55c83c43b510 | Triage

Analysis

max time kernel
185s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 10:42

Sharing

Report Analysis Logs

General

Target

Win7-8-10 汉化版/手机音响.exe
Size

1.3MB
MD5

b49d7d899cc86b6f9ad0ad01352d265a
SHA1

591f81c73dae6e07ff11c2d6f49ae57dbb41a712
SHA256

bbc6c0ed71bcdb6524231d4e9509217c35c26af9d5941228502ad395c2657850
SHA512

3d6f92ba1c902d67e3fd9087515cbbb349f363d44bd6de808b9cc0b7d0abc70daa26e4613c3010d6c1f28b955abe7291ee974ed0bb5bd54635eaf97542940616
SSDEEP

24576:eSdM0FAvlsVNmP+Pxp17bGV04YZDB4fx/Jk:tFAGVNmPqZ

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2308	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2308	AUDIODG.EXE
Token: 33	4716	手机音响.exe
Token: SeIncBasePriorityPrivilege	4716	手机音响.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4716	手机音响.exe
4716	手机音响.exe

C:\Users\Admin\AppData\Local\Temp\Win7-8-10 汉化版\手机音响.exe
"C:\Users\Admin\AppData\Local\Temp\Win7-8-10 汉化版\手机音响.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4716

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x490
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads