d80e4c73b0c935df6df76254e917981032ba29630e396e998f3a614c4743ade6 | Triage

Resubmissions

11-01-2023 15:09

230111-sjjjeshb7t 4

11-01-2023 14:47

230111-r547kshb5v 1

Analysis

max time kernel
386s
max time network
392s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-01-2023 14:47

Sharing

Report Analysis Logs

General

Target

Approved Paid Copy ATT738748403.js
Size

1KB
MD5

ad6404563d49c225f31b5798a44afc85
SHA1

54064731689ec08f6a1db57e4ebf2240e3762249
SHA256

d80e4c73b0c935df6df76254e917981032ba29630e396e998f3a614c4743ade6
SHA512

e3b3463ad6b08ec4092b25911698d7c08cdf2fbea44aa99ad81dcdb74c2f54cd10f0ee5747643acb3e7d731edcedb29cef2a370a322d5de3ddad1064278a12a3

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2040	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2040	AUDIODG.EXE
Token: 33	2040	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2040	AUDIODG.EXE

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Approved Paid Copy ATT738748403.js"
1⤵
PID:2016

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:692

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x550
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-54-0x000007FEFBF41000-0x000007FEFBF43000-memory.dmp

Filesize
8KB

Download