Analysis
-
max time kernel
19s -
max time network
11s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14-04-2023 19:28
Static task
static1
Behavioral task
behavioral1
Sample
Valyse Launcher.exe
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Valyse Launcher.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
Valyse Launcher.exe
-
Size
9.9MB
-
MD5
19eb60dc5db6c80e42a2ddb484eeb062
-
SHA1
7bbf48a3cb769358eca14892cac3bf8909a3850a
-
SHA256
5a00c251b2bccf4a498e7f82b1e7acc5975d9ec875236c7ec78f7eba82481adb
-
SHA512
942fffb751fb942925f3b4e654532e59efd0298f8a25c3278f0489185b87027722ad295cae4aac40eb144491cc74acba74dd1625719a4d9e2a7be7fefb16d93b
-
SSDEEP
196608:hmuXWqZHqT1s7pZMkv+GMvcu82wuJ11q6xpQDmLldLUnD1TJEfEj:/Bqq7DMkvLM1Lq6rwmQnpKfEj
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 832 Valyse Launcher.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 832 Valyse Launcher.exe Token: 33 1372 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1372 AUDIODG.EXE Token: 33 1372 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1372 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Valyse Launcher.exe"C:\Users\Admin\AppData\Local\Temp\Valyse Launcher.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:832
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5501⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372