ee91382baef48e16cad6a0a6d1843caf26b4c633ffc10d42ca0704682e802cce | Triage

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 23:24

Sharing

Report Analysis Logs

General

Target

petition-20230331T232017Z-001.zip
Size

178B
MD5

773d9fbe2eaa4a3db89d4f71c9bcd2f1
SHA1

bcdac162fdaadcd51ff03528789c5c9e478d8ed4
SHA256

ee91382baef48e16cad6a0a6d1843caf26b4c633ffc10d42ca0704682e802cce
SHA512

09b414d5931c197c2facbc441d0eda655fba0bc717f5f42c9a36d2de06c68aa7ac54a370a3097e9c902ce2388132a4f178a6ab9f11c599ae661c296fd1a48d67

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	636	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	636	AUDIODG.EXE
Token: 33	636	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	636	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\petition-20230331T232017Z-001.zip
1⤵
PID:1316

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1312

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x56c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads