1f89d37ada3c10c2fa845757e9ceafc42c0229b8b2a1ee9a05b0064c15326c0c | Triage

Resubmissions

09-05-2024 13:11

240509-qfepysbc2x 3

09-05-2024 13:08

240509-qdlqgsea35 3

09-05-2024 13:02

240509-p92k5sag8y 3

Analysis

max time kernel
62s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 13:11

Sharing

Report Analysis Logs

General

Target

Test.exe
Size

6.7MB
MD5

c04a280acea28e9b0c5e3790443f2215
SHA1

5c6d66bc3df5dae496883a910d17a9a174f1f2d1
SHA256

975da5565e1c0bb162a0e81ac16e781ab1a403112ab6ac96d5f4acb25477c97f
SHA512

7f697032bc4ad99a79e1fc7fac708f0f31678f338228f53707d33bc7bc2e0b753210c57df97e901723c741dfbd5bf97e9c8812f5ba9f1ede7c9c6cee2b795e6e
SSDEEP

196608:YGpCAFwgiOezfgOXbmDVkdwOis7TecaB/5nn2Qj4LQqyE5:HkwOJfsR2Ws35

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3304	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3304	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1840	Test.exe
1840	Test.exe

C:\Users\Admin\AppData\Local\Temp\Test.exe
"C:\Users\Admin\AppData\Local\Temp\Test.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1840

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3304

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads