1507118f528232defccaa4b670e7e72fbcf1a97e272114425517b49133cf8ee7

Analysis

max time kernel
104s
max time network
103s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-03-2023 04:36

Target

united+scientific+equipent.zip
Size

577KB
MD5

c942c21bcd6dbebdbe2ea20d19b1fbc7
SHA1

79ec41591a47a34a8ab123b217533673d17ebc0d
SHA256

1507118f528232defccaa4b670e7e72fbcf1a97e272114425517b49133cf8ee7
SHA512

2e4ed826ca26d6fb1080ac5da78d1fc90a4b5039643d1475aa72f9083163f83d02f3dd836b546d9aa1740df5d62995861f0e671ea7b130daa40dcc15224ebafe
SSDEEP

12288:z+beeYnIsTZTrlbCcllLRr7VyNYQChdcKHOysMaqsI142oxyX+UrDh15:zU0IuZTrtHFKNsdP51zcxybZ15

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	432	AUDIODG.EXE
Token: 33	432	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	432	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\united+scientific+equipent.zip
1⤵
PID:1724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x15c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:432