c3704d9a70d0ad5a30590190e69f4748de1e232042bfbd6d43a3ea6f573dc18c

Resubmissions

06-02-2023 08:40

230206-kk236acg99 10

06-02-2023 08:37

230206-kjc3mscg93 10

06-02-2023 07:50

230206-jpbw4acf42 10

Analysis

max time kernel
114s
max time network
104s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

008ad6f06b42fa51f990a67d08a39cae.zip
Size

3.3MB
MD5

1cefb61bc04d04ac2db1d0dc447cea1a
SHA1

0041a52155376c216ebe9544a3ad3197388b0355
SHA256

c3704d9a70d0ad5a30590190e69f4748de1e232042bfbd6d43a3ea6f573dc18c
SHA512

e9ab6191648c908f3636c41d805aca0b1a9947adcb8a19fac42b3d6e1351b240021d307366a5b005f8cd15164774fe3c5fd390ae26edee7e00ce431669719f89
SSDEEP

49152:qWP7+TTAbkk60inpejudKswewO8DphzsDL4kDPDLAkJ7jWqNle:qWwvxndKzewO8Dphzyck7TJ7jWz

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

taskmgr.exe

pid process

672 taskmgr.exe
672 taskmgr.exe
672 taskmgr.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

taskmgr.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	672	taskmgr.exe
Token: 33	1048	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1048	AUDIODG.EXE
Token: 33	1048	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1048	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 29 IoCs

Processes:

taskmgr.exe

pid	process
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe

Suspicious use of SendNotifyMessage 29 IoCs

Processes:

taskmgr.exe

pid	process
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe
672	taskmgr.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\008ad6f06b42fa51f990a67d08a39cae.zip
1⤵
PID:1540

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:672

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:468

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1bc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1048

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-54-0x000007FEFC091000-0x000007FEFC093000-memory.dmp

Filesize
8KB

Download
memory/672-55-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads