Analysis
- max time kernel
136s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20230824-en - resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system - submitted
27/08/2023, 08:50
Behavioral task
behavioral1
Sample
mp3studios_92.exe
Resource
win7-20230824-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
mp3studios_92.exe
Resource
win10v2004-20230824-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target mp3studios_92.exe
- Size 1.5MB
- Sample230827-krydjsge23
- SHA256 4a384670a860d25077da61d68413298186d8d82cb3aca20b695066f18e425759
- MD5 7b64a5e509aa84c4ad87989675f79f07
- SHA1 0ec3f2cc002c38d8b4bc41f9887075e054ca99ae
- SHA512 a5093896837e00bdddf80b438f1d38fac4faa4f4cd259812f5930d4b501b1716a361cbd67a55192ee0226ebbe2dc9987590f4c0e0fbe31c7d7a0d71c92197f9d
- SSDEEP 24576:XJSLpwfVWRh0SGQ48Lm2194mKa4qrNkW9NTPjB5NqBm7gm:Xup62ESMyjTPjBDqQ7gm
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 3536 1232 WerFault.exe 84 - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeCreateTokenPrivilege 1232 mp3studios_92.exe Token: SeAssignPrimaryTokenPrivilege 1232 mp3studios_92.exe Token: SeLockMemoryPrivilege 1232 mp3studios_92.exe Token: SeIncreaseQuotaPrivilege 1232 mp3studios_92.exe Token: SeMachineAccountPrivilege 1232 mp3studios_92.exe Token: SeTcbPrivilege 1232 mp3studios_92.exe Token: SeSecurityPrivilege 1232 mp3studios_92.exe Token: SeTakeOwnershipPrivilege 1232 mp3studios_92.exe Token: SeLoadDriverPrivilege 1232 mp3studios_92.exe Token: SeSystemProfilePrivilege 1232 mp3studios_92.exe Token: SeSystemtimePrivilege 1232 mp3studios_92.exe Token: SeProfSingleProcessPrivilege 1232 mp3studios_92.exe Token: SeIncBasePriorityPrivilege 1232 mp3studios_92.exe Token: SeCreatePagefilePrivilege 1232 mp3studios_92.exe Token: SeCreatePermanentPrivilege 1232 mp3studios_92.exe Token: SeBackupPrivilege 1232 mp3studios_92.exe Token: SeRestorePrivilege 1232 mp3studios_92.exe Token: SeShutdownPrivilege 1232 mp3studios_92.exe Token: SeDebugPrivilege 1232 mp3studios_92.exe Token: SeAuditPrivilege 1232 mp3studios_92.exe Token: SeSystemEnvironmentPrivilege 1232 mp3studios_92.exe Token: SeChangeNotifyPrivilege 1232 mp3studios_92.exe Token: SeRemoteShutdownPrivilege 1232 mp3studios_92.exe Token: SeUndockPrivilege 1232 mp3studios_92.exe Token: SeSyncAgentPrivilege 1232 mp3studios_92.exe Token: SeEnableDelegationPrivilege 1232 mp3studios_92.exe Token: SeManageVolumePrivilege 1232 mp3studios_92.exe Token: SeImpersonatePrivilege 1232 mp3studios_92.exe Token: SeCreateGlobalPrivilege 1232 mp3studios_92.exe Token: 31 1232 mp3studios_92.exe Token: 32 1232 mp3studios_92.exe Token: 33 1232 mp3studios_92.exe Token: 34 1232 mp3studios_92.exe Token: 35 1232 mp3studios_92.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mp3studios_92.exe"C:\Users\Admin\AppData\Local\Temp\mp3studios_92.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 15922⤵
- Program crash
PID:3536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1232 -ip 12321⤵PID:3032