b3f07ff0a6072229a70340af596c1f898030177065f4fda75b951813928b6c94

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 15:39

Target

Veinminer.zip
Size

16KB
MD5

fe6b4301262f7bce5589332278754152
SHA1

7093b8c834584498c2eb54b4340f5300d6e2ba9b
SHA256

b3f07ff0a6072229a70340af596c1f898030177065f4fda75b951813928b6c94
SHA512

f2b01a0595fe830a1d7af5ccefcc40c1fe8eb55f86c6506aa23a1cde92f8636e51d849f1e305c04b7f147071de115cc18a694a9f98e4dacbbe3dd2e1554e0fad
SSDEEP

192:tqaemSSBkX4b9lNM84Bl0dxPWV33MjvJ8VVj2TG00PJs3fs01Xcwuvk+hyMlneE:X0SBi4bZ8yd4sjK/0ws3fV4k0lH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1916	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1916	AUDIODG.EXE
Token: 33	1916	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1916	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Veinminer.zip
1⤵
PID:2132

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1916