e601e2249d2ed99e05552157a32aa73fb476f2b55bb63d10f9a3405d8269c693 | Triage

Resubmissions

08-05-2023 12:04

230508-n83alscc6v 10

14-02-2023 12:24

230214-pljenacf6s 1

14-02-2023 12:00

230214-n6rq4adb47 10

14-02-2023 11:52

230214-n1s2zace3s 10

24-01-2023 09:45

230124-lrfn6sad97 10

Analysis

max time kernel
42s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-02-2023 12:24

Sharing

Report Analysis Logs

General

Target

8843202280.zip
Size

139KB
MD5

40e3640ea2cd1731cb3c265e1ca80c94
SHA1

9c90da2647d02351c90247cf9fde770096a37e0d
SHA256

e601e2249d2ed99e05552157a32aa73fb476f2b55bb63d10f9a3405d8269c693
SHA512

19993b49f291108288d6cd8bfca2f48a90e88487c7475019cc993d36e814e0aaf53a745646adc0970f03b3a13a84c23b422939094cfbcde2f3df071a951f9605
SSDEEP

3072:1EA+AEZqewODWcC75vdGLZA/t++hIea4TErNJy3zhWN:X+fwODWIWTh+NQ3zhWN

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1000	AUDIODG.EXE
Token: 33	1000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1000	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\8843202280.zip
1⤵
PID:2036

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-54-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download