2e1e3f75fdb08c26e41d7870db6ffea5b89b39100899fe609b3c1d0d018c87d3 | Triage

Resubmissions

14-06-2024 14:23

240614-rqapesxhrn 3

17-04-2024 09:42

240417-lpnl1abc26 4

Analysis

max time kernel
148s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 09:42

Sharing

Report Analysis Logs

General

Target

d_win_x32.exe
Size

18.2MB
MD5

b0b210e7c42a5423f51facac60afddfb
SHA1

e247508b0f1bffd7219f1017595dcff1470bd4bd
SHA256

b81734717f36d3cea59e5690b984333c5a6908a15883a0463d77cb20dadcec0c
SHA512

57bea2efeca1ad80a63568806a4ff588dae5cd8f11cd9399c9947f71fe25123edc6597cdc1bf6485cf322b57df05b4b0f44dd663205ad89c1fab21b8834cf8ff
SSDEEP

196608:SOVsWpl6YRitqToH+61nvMb4X7+qVR7vkHa2:SOV3k62lv8wzj7qr

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	d_win_x32.exe

C:\Users\Admin\AppData\Local\Temp\d_win_x32.exe
"C:\Users\Admin\AppData\Local\Temp\d_win_x32.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads