Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2023 10:57
Behavioral task
behavioral1
Sample
b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe
Resource
win7-20231020-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe
-
Size
1.5MB
-
MD5
623a05fe287ccf1c2a5e52de589e3313
-
SHA1
cf5b59404205eb0ea6863cda3ac73adcf6936e05
-
SHA256
b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115
-
SHA512
219af16fefe28a2ed40790d241f8efd806f7e048710cd459ea670ccfc0662757f960d23f2b48791cd7e8510842fb76fc7e5b16838be456db2cb0d2c256762e95
-
SSDEEP
24576:sEWnbDqMa30NjOufUcsPOFDSVXT5X4fnlOXwMhDgiya:vMDha3YOuf7sPO6XT5X4lE1ki1
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1688 b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe Token: 33 64 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 64 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe"C:\Users\Admin\AppData\Local\Temp\b30d0a2dbfb7446a1b9ad6d4dd5f6877122a0b3ae4d2d97f58995aa935727115.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x518 0x4e81⤵
- Suspicious use of AdjustPrivilegeToken
PID:64
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89B
MD5348beb1303020f7b1a6e904441419fe3
SHA13c2b039e85dd032e08be7626da1630edeff18fff
SHA2569b40d323a1bf0d36fd82dbd36784602e69107073507e8960ebe6c691dbcbda82
SHA512ec12127abc419484b65ebf60eead4b3d2289ead50d6879d664bf6e053050326b199a59f216855b631bc813b0e6cddd5e9640e53e70fd9eb1301646d1bc83850e