3a9f95216f3a25f1896dfe8d6ff497543a32643c763848c74a39775b1f110e41 | Triage

Analysis

max time kernel
126s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 15:37

Sharing

Report Analysis Logs

General

Target

inoccoece.exe
Size

200KB
MD5

c7eba2c6387849e8f1c2665f8f539574
SHA1

0bf38c1b904b8648500afb6605309c7e9422deed
SHA256

3a9f95216f3a25f1896dfe8d6ff497543a32643c763848c74a39775b1f110e41
SHA512

ed739d0a669651a761dc58b9a767ce2065cdc56f93d9699a96d135bd8b7003be5a0daea453139f18d0b60bd6cf231ff63e59ed7af3598fd08a520cfd9e3109a9
SSDEEP

3072:J++/5nNl6yLPWZD52D0E7ruqkfSvoUGjBNT2j8yT:JHnNl6yrWlUD0OrSO5MsjfT

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	632	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	632	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\inoccoece.exe
"C:\Users\Admin\AppData\Local\Temp\inoccoece.exe"
1⤵
PID:1572

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x398 0x2f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads