Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
39df4d4909f9913b06a47937ff07eaab.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
39df4d4909f9913b06a47937ff07eaab.exe
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
39df4d4909f9913b06a47937ff07eaab.exe
-
Size
608KB
-
MD5
39df4d4909f9913b06a47937ff07eaab
-
SHA1
957c53c58b7cb14fd07d9c6b064d31bd32c8def4
-
SHA256
6b386087c50c3452e83f1f0e92acda6813010fd4bf24458c261ba1a492d49ef3
-
SHA512
25a94bf57168c8c809dbfd9274e5e00fe6ed22207171e2be7888f58876ed624dd6ccab1b35693203800f34eaae141f0472c3faf1cfcf9e35f3bfd0dd153770eb
-
SSDEEP
12288:C0aIDG6w4fui0Ttau8rkLUfHHy/b7o1gHTZ+v4/5VHf:CVfWf09LUPHqb71z+gV/
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1880 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1880 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4228 39df4d4909f9913b06a47937ff07eaab.exe 4228 39df4d4909f9913b06a47937ff07eaab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39df4d4909f9913b06a47937ff07eaab.exe"C:\Users\Admin\AppData\Local\Temp\39df4d4909f9913b06a47937ff07eaab.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4228
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2cc 0x3fc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880