8109b2fe6fe61eec679d059c1e553c20777dde2b6b8200ce3bdf57b2f2068bf5

Analysis

max time kernel
115s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/04/2024, 05:45

Target
HA_SendLink191_Fire.exe
Size 481KB
Sample240411-gf4jmsdf42
SHA256 38a285fad90354c149689c2edcfbf2fa37441582fc97abfd4969739bc7df8c02
MD5 c70f92533a5e197dcfdcc2c5edbdd98e
SHA1 aab8d6bf5dec47e89bd34ad036b4edbc73444563
SHA512 fd22a20825ebd1342003210306a3bbf4f1cf9c80d819558543c98f73911b458f71de5d8294e689f265ec2e1366e19522346863934f836fca1fcb2d7874217dc6
SSDEEP 6144:FhF2fYDYYD+y82yhRHFSky3XEMV22Jl1F2BjplvitfMLuBTKP1265He0alrUHLY:fUTXJvHFSky3VV5Jl1F2BWBu126deHKU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Loads dropped DLL 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3988	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\HA_SendLink191_Fire.exe
"C:\Users\Admin\AppData\Local\Temp\HA_SendLink191_Fire.exe"
1⤵
- Loads dropped DLL
PID:4920

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3b8 0x41c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3776 --field-trial-handle=2232,i,11267738607351977302,107266978269557304,262144 --variations-seed-version /prefetch:8
1⤵
PID:1252

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd81C5.tmp\InstallOptions.dll
Size 12KB
SHA256 8203ae1589a50e6ff012e5d27bdd4f8ed7506077ca9b052827f5e90aaeb98519
MD5 1e8f2fefe3ce893b117b26948b8978cb
SHA1 59cfc6c3f5716e91609e54ca80ae8b06c93ef8ab
SHA512 b3c36e1aa5d3ee5f482f4175a7d6fe10cf2bf3bd3423ab4266d11c4181cfbc7e3f66a30855034a8ec026a4d5987598f0116e98519b7445d9e5687bcbab2c0e5c
SSDEEP 192:qzixixDOHhG9db9rd+oSVPECMlh3I8tqDyng7hwbbHF1QuCb:qOx0DOHqrdwTY6+ng72bbMum
MD5 SHA1 SHA512 SSDEEP

Submit Download

Splash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd81C5.tmp\Splash.dll
Size 4KB
SHA256 2ada4d9531a62772ddd7eeb0737fe91925982c543990d9c0d4faaadde12b7ed0
MD5 e07ad0d2f86ddf926911e3d2dbc2021e
SHA1 370c93de8c9ba9549b0a646b329cb8d2fc7c91f8
SHA512 c13747e3cb2d6712f3bf19bfe1bbbab47763239a4e21bbe685edbedae98bda9c7b8e4e06c22e8b7737752a3c3129e07c91c00b6e90ac741e891bc1bfa966fdae
MD5 SHA1 SHA512

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd81C5.tmp\System.dll
Size 10KB
SHA256 7a24883bdbf08ce90938094b6ab6f09a842af10b18b8ae4d70da2e6b806490b8
MD5 10c44246d99a1c2e5f5e6b52b111a63d
SHA1 0f41da79c3e789f4ae38738e3a5d73c538f8af4f
SHA512 e5b0fa27cd02a67be5eb9c63646621d3e9ccfada98659c50dee8310a58ce12e1a6a059788b85f0f440067ed7e281a0e1a526b9403993b9000f91a51bfbb50da3
SSDEEP 192:rOSsJI/rqmIDNLU0dq51EgAiNbubv6rLZ:lHQQ0d01Egbq76r
MD5 SHA1 SHA512 SSDEEP

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsd81C5.tmp\ioSpecial.ini
Size 609B
SHA256 dec41e7a73c4c098336935dbc1914b0063567f83d6606a365d848d06dd670f66
MD5 0eb9f7d6b59d92920badae59aca7b6fa
SHA1 c89e103ffaaddf020efb18004422089fa4756084
SHA512 a08747e1868b37aa2df01ec14701546a0628718f43726f30dc7ad043e5ef2805c365ed73aa750154b19d4afb54e2977375b7f8f63e92b42a9e9a9d7e21b8ee4f
MD5 SHA1 SHA512

Submit Download