28b431c1c8ebc715806b466b14398a4528c5d35e9d486f9004700626ed5960d4 | Triage

Analysis

max time kernel
134s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
08-12-2023 00:06

Sharing

Report Analysis Logs

General

Target

CLIPStudioPaint.exe
Size

35.5MB
MD5

dc29ddaa82b29ca9e433938072adf19c
SHA1

f8acc984c931e0ccdf3160900e1e6bb0d2b6b105
SHA256

28b431c1c8ebc715806b466b14398a4528c5d35e9d486f9004700626ed5960d4
SHA512

de04d5ada42b6f8814601d2421ab6f0cecad2a057cd271bf716804beecb762ced1b85de478bf84614fcf2e66a811b8194148b632fa5aae0c8cc409432bce525a
SSDEEP

786432:D9mXDp8KhF3fW6Gu4HlE6L3xh/8o5PQp9T5USrl/EvwI5:UDp8KhFUdhh/8o5opt5USrlcv/5

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1076	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1076	AUDIODG.EXE
Token: 33	1076	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1076	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\CLIPStudioPaint.exe
"C:\Users\Admin\AppData\Local\Temp\CLIPStudioPaint.exe"
1⤵
PID:1396

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2656

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1076

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...