c6a916c33096cd488ca57c28863c433cf5279128aa50ea156761bab6444f4937

Analysis

max time kernel
357s
max time network
360s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-02-2024 11:28

Target

MalwareCollection-master/Ransomware/Ransomware.NoMoreRansom.zip
Size

916KB
MD5

032f198b7b5d9553ba2e7bf34d9f33c0
SHA1

23bb43f6991b59516b20ed7d07cc55879a9192f2
SHA256

a1a0c26a3976bd07fae54519d2ca62818987ddcb7ae8dd44cebc710c1928548b
SHA512

92f9f0dfce9b48602d87d86d6e73f308573168a01e851982d1a0a0baa76568495b5815a3ed11928463db5f5aa8b6d0b685968588eb75ef9624ae5b9355922788
SSDEEP

24576:whK+SCleARYrlhgOZiapPMOiwtCd8BvABnU0FJtjVcW7:whVSCRAhgMia+OFnFAVtpZ7

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1212	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1212	AUDIODG.EXE
Token: 33	1212	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1212	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\MalwareCollection-master\Ransomware\Ransomware.NoMoreRansom.zip
1⤵
PID:2036

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212