45438e0d6a47a90beea24d4bb1d0a4387032a12a9b7d64b2e08986cbfb264406 | Triage

Resubmissions

11-03-2023 15:20

230311-sqvv2abh7w 7

11-03-2023 13:56

230311-q8tpksbf8y 10

Analysis

max time kernel
38s
max time network
30s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-03-2023 13:56

Sharing

Report Analysis Logs

General

Target

Desktop.zip
Size

441KB
MD5

9939ec0b4762cb5f5aef3116ec62763d
SHA1

b6571f2c205412d9c7b2cf0a5aabda448844b634
SHA256

45438e0d6a47a90beea24d4bb1d0a4387032a12a9b7d64b2e08986cbfb264406
SHA512

d3a1314e0f44de3f20aae125851173e36a704daf0fcf14327b1c9341059311c3174e5aad274f5cbad08e8b71bbdaa93f590f2480f5c3ec6b7d0fe2c546125a6f
SSDEEP

12288:FCK5maH/V4sBXIxzv1C0sSihBVW6CDg1K1on61UDhG:T7C5S072BlCk14on61kG

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1692	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1692	AUDIODG.EXE
Token: 33	1692	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1692	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Desktop.zip
1⤵
PID:1372

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1720

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads