9127560918eaefe69f1959bcb7f7e13b7e3a7ac156b564922829faaec9b96f67 | Triage

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 17:41

Sharing

Report Analysis Logs

General

Target

salinewin-safety.exe
Size

245KB
MD5

601283c004aa6e4bcebfb6e844eb653c
SHA1

9c3dde5abd1056497f03f5ae5a3dc6ffed1028cf
SHA256

279a19315055e93a80c558bf9d9a7c8b4aba8fc8f8f3e812df8619e959abbcae
SHA512

feeaebc7c097c724f0cea539729729a7512eb0c75c45b7395cd1d7b3ab643f11fb8b941373b30b12d14b837ff53793fdf49fd70f524c9f6391285d62cf4a7c06
SSDEEP

3072:0Rz5n9Sae432oSLsMT3myjTvoTboVEBZP5pHQpYR95WPNp1wH:0T64a74LZPPHQpY35WPNpW

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1372	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1372	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\salinewin-safety.exe
"C:\Users\Admin\AppData\Local\Temp\salinewin-safety.exe"
1⤵
PID:5068

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a4 0x408
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4040 --field-trial-handle=2288,i,10301911031503898037,2997280636231771547,262144 --variations-seed-version /prefetch:8
1⤵
PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads