40e30c38e66740202f3a01f90c3d6fc34efd609e247f20dfcd23a6a3f2dabf97

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
05-07-2023 12:50

Target

get.zip
Size

2.6MB
MD5

783597870319e8fc1c818c5f13e28a0d
SHA1

b71f9a2ad0bd245ab4d4666f005cd5050f7f2770
SHA256

ca5837c6b4cdde0e3ef9942ba308ca19e9b51439048bd0c2fcf5753e1403a517
SHA512

ef4894e7c942e275371580b9644763f123a72421314452f2dbb5c706709656f30ddbf58be2ac691b14ebd4b4aff45601a5e58a4dbd10e50d40cd9f40fe12411f
SSDEEP

49152:gCkbPBzS7ULCbGyDboE8wrupidLNDNVeC1T5nY5tHfswXNWoUr3EHDMYCpsmiP7:gpDBzS7UL+G3q5V7y5JB9WBUHIYCpsT7

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1944	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1944	AUDIODG.EXE
Token: 33	1944	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1944	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\get.zip
1⤵
PID:2380

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:2356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944