891282d24b7a20e98b066eff9ff98f0698fa52de1bfba29aab0e0a92a464057b | Triage

Resubmissions

29/06/2023, 02:49

230629-dbah8acg2t 3

29/06/2023, 02:47

230629-dac8qacg2s 1

29/06/2023, 02:43

230629-c7zbsabg67 3

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
29/06/2023, 02:47

Sharing

Report Analysis Logs

General

Target

nitro-generator-master.zip
Size

4KB
MD5

5d81e0a74628094e83533eb23b5e2bf7
SHA1

fa18c81b9e33e3c2e7bb2a0b7cffa71c8a990ece
SHA256

891282d24b7a20e98b066eff9ff98f0698fa52de1bfba29aab0e0a92a464057b
SHA512

57fcb8b68669c2ddf2fa06e7540337de8f3ce8f88fc26aefc690147361e09c28d36edc3e1d6e3e0fd5dcc99bbf83c4d98f836cdb5d877c019cfa9043be6386f1
SSDEEP

96:AaJB9tgx4Cx/8zWfgoHwsAyaEwWhFZwEmEQrJzm3jxk:LB9ErFA4wWhMnr8C

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1620	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1620	AUDIODG.EXE
Token: 33	1620	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1620	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\nitro-generator-master.zip
1⤵
PID:2036

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:524

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ac
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads