Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/07/2023, 09:07
Static task
static1
Behavioral task
behavioral1
Sample
e34a0063d848b70dc26b96c8cf5fde9893de312c93de2fe8aaa08fcac01724cf.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
e34a0063d848b70dc26b96c8cf5fde9893de312c93de2fe8aaa08fcac01724cf.exe
Resource
win10v2004-20230703-en
General
-
Target
e34a0063d848b70dc26b96c8cf5fde9893de312c93de2fe8aaa08fcac01724cf.exe
-
Size
5.9MB
-
MD5
5d96a209d067c1dbba91eaf4926c966d
-
SHA1
ed75224ddc8fc1818e3ae8c64a342c6ecf8c4cdc
-
SHA256
e34a0063d848b70dc26b96c8cf5fde9893de312c93de2fe8aaa08fcac01724cf
-
SHA512
5fbed9ec1b8c920e4bdf8351c15ed40fef21ef3b54bd44d7bcd9a6a7f7c283ac6dcc9a4406d43ef19539746552b0f8c8b6217ddf2e4f2ed7dc9a6ee04d981a39
-
SSDEEP
98304:oVzp5s5j2aDKHeeDuZehYPr/SoxJTFuJpZ2JqLK+/V7SUNB+R9QZbA4KKKTc:29Cl2aDKHFha//FuJZL5NNB+R9oAfKZ
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4960 e34a0063d848b70dc26b96c8cf5fde9893de312c93de2fe8aaa08fcac01724cf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3700 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3700 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\e34a0063d848b70dc26b96c8cf5fde9893de312c93de2fe8aaa08fcac01724cf.exe"C:\Users\Admin\AppData\Local\Temp\e34a0063d848b70dc26b96c8cf5fde9893de312c93de2fe8aaa08fcac01724cf.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4960
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x490 0x2ec1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3700