886eb38e77b5d5201507670852dd35b0c52ca09794f1e4dd2921b75453ce924c | Triage

Resubmissions

08-11-2022 19:50

221108-yklm3agahq 10

08-11-2022 19:00

221108-xn2m1scfg4 3

Analysis

max time kernel
103s
max time network
83s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-11-2022 19:50

Sharing

Report Analysis Logs

General

Target

Scan_Document4852-(Nov8).iso
Size

1.0MB
MD5

bf64419cd700304a2b025571f1663bc0
SHA1

2b3ac60c3ace02bc7149b21b1fabe3ed8574e59c
SHA256

886eb38e77b5d5201507670852dd35b0c52ca09794f1e4dd2921b75453ce924c
SHA512

46812da6ecb036749dbf1efbc5afa98da5add5b6fe60a94d51e440a7bc7f3ffa3b23c4d418532f8c94455be26c33a241391fd9a3b4e5205b60b8c17bb4579398
SSDEEP

24576:4ZDtIk9GUX8zVzpSZe1Sn7xbRHCaGOGZ3Sz3y/0F+:mDtjBkwe1sdCaGp94Co

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1684	AUDIODG.EXE
Token: 33	1684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1684	AUDIODG.EXE

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Scan_Document4852-(Nov8).iso
1⤵
PID:1992

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\System32\isoburn.exe
"C:\Windows\System32\isoburn.exe" "C:\Users\Admin\AppData\Local\Temp\Scan_Document4852-(Nov8).iso"
1⤵
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-54-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Filesize
8KB

Download