9b16a768a855dac850fcc3420dd0e13a5508f1c94f408ccdd13820ee914a33fc

Analysis

max time kernel
142s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 21:46

Target
logo.exe
Size 539KB
Sample240229-1mxt8adh45
SHA256 7e1eb3f94e7f5b623c33603dc98071adf5c3fb439a0c81b427abe186902ae120
MD5 ad552bb94412cfc556cf0d11d1adb306
SHA1 7e2f06e43b9413730aa6af10d6668126ec894cb2
SHA512 567d7bd6a235cf485b178e123aeaca4fa729c6bfc9a8f251e529835b3f37f87e842a466b1af053cd224d0b67c9d499852b2d678d1464d6c51160c2b497863e99
SSDEEP 12288:XOfS9sIjxBlpHDfz3DPk7XxFEGhSsfzSAE4a5:efSdzTHDfXc7X3EGTbw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5116	logo.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5060	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5060	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\logo.exe
"C:\Users\Admin\AppData\Local\Temp\logo.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:5116

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:5112

memory/5116-0-0x0000000000400000-0x000000000050C000-memory.dmp

Download

memory/5116-9-0x0000000002520000-0x0000000002521000-memory.dmp

Download

memory/5116-10-0x0000000000400000-0x000000000050C000-memory.dmp

Download

memory/5116-11-0x0000000000400000-0x000000000050C000-memory.dmp

Download