Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
08-12-2023 00:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CLIPStudioPaint.exe
Resource
win7-20231020-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
CLIPStudioPaint.exe
Resource
win10v2004-20231130-en
0 signatures
150 seconds
General
-
Target
CLIPStudioPaint.exe
-
Size
35.5MB
-
MD5
dc29ddaa82b29ca9e433938072adf19c
-
SHA1
f8acc984c931e0ccdf3160900e1e6bb0d2b6b105
-
SHA256
28b431c1c8ebc715806b466b14398a4528c5d35e9d486f9004700626ed5960d4
-
SHA512
de04d5ada42b6f8814601d2421ab6f0cecad2a057cd271bf716804beecb762ced1b85de478bf84614fcf2e66a811b8194148b632fa5aae0c8cc409432bce525a
-
SSDEEP
786432:D9mXDp8KhF3fW6Gu4HlE6L3xh/8o5PQp9T5USrl/EvwI5:UDp8KhFUdhh/8o5opt5USrlcv/5
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1076 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1076 AUDIODG.EXE Token: 33 1076 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1076 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\CLIPStudioPaint.exe"C:\Users\Admin\AppData\Local\Temp\CLIPStudioPaint.exe"1⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c1⤵
- Suspicious use of AdjustPrivilegeToken