4b41c20da6812bdc2c6231f043dc4f2d3bc30843a6e08678ed9178bea9a7323a | Triage

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 15:30

Sharing

Report Analysis Logs

General

Target

Melatonin.exe
Size

626KB
MD5

967b51e1dfdf73116cb6d5c97d1a73fd
SHA1

d602f579756233d71de93f6684d21e6ff5d7658e
SHA256

4b41c20da6812bdc2c6231f043dc4f2d3bc30843a6e08678ed9178bea9a7323a
SHA512

2c7c0d535a770762dbd6a3d3c1ddac0e83701b0cb73b435629bce137221eb80085ac8303e9d53cd815ba26e61772779916a0853fe2b3a851824d7771d2550676
SSDEEP

6144:yqA0bOu5YZoZhltOSpvc0gpeMnDHqVjcs:yqA3u5YZoZDtOR0gpBHkjcs

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1684	AUDIODG.EXE
Token: 33	1684	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1684	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Melatonin.exe
"C:\Users\Admin\AppData\Local\Temp\Melatonin.exe"
1⤵
PID:1204

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1460

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads