79d352413ec91e3c74925718fd3a7e8d6f234d62a2ceffb6a1e7c5b257ec48e9

Analysis

max time kernel
121s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 17:03

Target
$0/ILMinihostBridge64.exe
Size 3.0MB
Sample240224-vkn7eaha52
SHA256 305d88f08355250eb2c3db78213264ce5b6ef69b3990710d04ae1dea72a5919b
MD5 4226dc45950473419e8f3ef1503d27b3
SHA1 9e7de1cc2a8d8066dca588672a43bf79abbd863b
SHA512 55c3972f77f565c8d93f1ab1fc6c1a1097851e90be6eab48494c58a85c14020f78f71b495f8deb1d5e99b4c9c4409d524ff50b265346bc2da5067f830a7a2762
SSDEEP 24576:777Pbvc6pEyjLZ1J1BHutiTvFHdQ0PIMayFr7+3+hNkDT7N+dBKJe3/0:zjbhZwiDbhKyF/+uUDT1JI/0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4556	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4556	AUDIODG.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 1948	4388	ILMinihostBridge64.exe	86
PID 4388 wrote to memory of 1948	4388	ILMinihostBridge64.exe	86

C:\Users\Admin\AppData\Local\Temp\$0\ILMinihostBridge64.exe
"C:\Users\Admin\AppData\Local\Temp\$0\ILMinihostBridge64.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Users\Admin\AppData\Local\Temp\$0\ILMinihostBridge64.exe
  C:\Users\Admin\AppData\Local\Temp\$0\ILMinihostBridge64.exe Bridge42ccd6c72486c942ad8c948451eb084 Bridgeac23bc995f10934284f3aa6e822a16c "c:\program files (x86)\vstplugins\tal-bassline.dll" no
  2⤵
  PID:1948

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x49c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4556

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact