Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system - submitted
27/08/2023, 08:54
Behavioral task
behavioral1
Sample
mp3studios_6.exe
Resource
win7-20230712-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
mp3studios_6.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target mp3studios_6.exe
- Size 1.4MB
- Sample230827-ktxj2age43
- SHA256 9a84a9001644e7200e984dfc45884e3e9e87bcbd5b3b212e410dcdaaf71336c9
- MD5 4991dbb29f6f702174e974e8c2224c1d
- SHA1 15b4874d3b8ee4c54aa44d77b92f4032be33a936
- SHA512 ea051008f69c990e54f75a07de0aef30fb4cc56ec403c44be2f0420fabea9b95511c45de511679bec7f9f2622c62546cbe8ab53e2292f0393f00f81af3364f99
- SSDEEP 24576:IJSLpwfVWRh0SGQ48Lm2194mKa4qrNdW9NTPjVt5qBlzu:Iup62ESMTjTPjVTq/zu
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Program crash 1 IoCs
pid pid_target Process procid_target 1332 3812 WerFault.exe 81 - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeCreateTokenPrivilege 3812 mp3studios_6.exe Token: SeAssignPrimaryTokenPrivilege 3812 mp3studios_6.exe Token: SeLockMemoryPrivilege 3812 mp3studios_6.exe Token: SeIncreaseQuotaPrivilege 3812 mp3studios_6.exe Token: SeMachineAccountPrivilege 3812 mp3studios_6.exe Token: SeTcbPrivilege 3812 mp3studios_6.exe Token: SeSecurityPrivilege 3812 mp3studios_6.exe Token: SeTakeOwnershipPrivilege 3812 mp3studios_6.exe Token: SeLoadDriverPrivilege 3812 mp3studios_6.exe Token: SeSystemProfilePrivilege 3812 mp3studios_6.exe Token: SeSystemtimePrivilege 3812 mp3studios_6.exe Token: SeProfSingleProcessPrivilege 3812 mp3studios_6.exe Token: SeIncBasePriorityPrivilege 3812 mp3studios_6.exe Token: SeCreatePagefilePrivilege 3812 mp3studios_6.exe Token: SeCreatePermanentPrivilege 3812 mp3studios_6.exe Token: SeBackupPrivilege 3812 mp3studios_6.exe Token: SeRestorePrivilege 3812 mp3studios_6.exe Token: SeShutdownPrivilege 3812 mp3studios_6.exe Token: SeDebugPrivilege 3812 mp3studios_6.exe Token: SeAuditPrivilege 3812 mp3studios_6.exe Token: SeSystemEnvironmentPrivilege 3812 mp3studios_6.exe Token: SeChangeNotifyPrivilege 3812 mp3studios_6.exe Token: SeRemoteShutdownPrivilege 3812 mp3studios_6.exe Token: SeUndockPrivilege 3812 mp3studios_6.exe Token: SeSyncAgentPrivilege 3812 mp3studios_6.exe Token: SeEnableDelegationPrivilege 3812 mp3studios_6.exe Token: SeManageVolumePrivilege 3812 mp3studios_6.exe Token: SeImpersonatePrivilege 3812 mp3studios_6.exe Token: SeCreateGlobalPrivilege 3812 mp3studios_6.exe Token: 31 3812 mp3studios_6.exe Token: 32 3812 mp3studios_6.exe Token: 33 3812 mp3studios_6.exe Token: 34 3812 mp3studios_6.exe Token: 35 3812 mp3studios_6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mp3studios_6.exe"C:\Users\Admin\AppData\Local\Temp\mp3studios_6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 19002⤵
- Program crash
PID:1332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3812 -ip 38121⤵PID:2256