91518566e4ce772a383bc21260f7ccacbde0cc5c4251c5e1211dbe34d792e3f2 | Triage

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-12-2022 16:46

Sharing

Report Analysis Logs

General

Target

javaw.exe
Size

38KB
MD5

cf286302dae37f2253653c6bd57680b0
SHA1

52e73bfcf6906560ad1631216e5658662e9b3b46
SHA256

91518566e4ce772a383bc21260f7ccacbde0cc5c4251c5e1211dbe34d792e3f2
SHA512

6b63dc431f6a68e1b0b3a8a8c6ccedbca8d95f6882f3041e970d15d59a60ee5777a578176d74015cd7860d08cae6741b989dd990594c208a366bd3d9f0a059aa
SSDEEP

768:DXGFo2gM5R2TyJ5R3s8D/bkt5Ruz3Vb39+5:DX9M5RdJ5R3sozkt5RA39+5

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1340	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1340	AUDIODG.EXE
Token: 33	1340	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1340	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\javaw.exe
"C:\Users\Admin\AppData\Local\Temp\javaw.exe"
1⤵
PID:1796

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x484
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:1280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-54-0x000007FEFBCE1000-0x000007FEFBCE3000-memory.dmp

Filesize
8KB

Download