b35b39cda1203061b1c76786859790cce658bef58e1506b9d34a41c9b6a0596c

Analysis

max time kernel
151s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 16:38

Target

ASEAG Facelift.rar
Size

42.2MB
MD5

7b8256ad95a1fe26094d348f5287742a
SHA1

7513650a2123a94dcf4fe42be6f7975ef12dd068
SHA256

b35b39cda1203061b1c76786859790cce658bef58e1506b9d34a41c9b6a0596c
SHA512

64bf4d4cab170c3d6040771207e8971af0313bc165ea84e4a685445c81a7d8f9549bfff697abd5c09006df61d84a77e3e68e52e51c07411204bcb91fb00be19a
SSDEEP

786432:XtUnS3wMaYnE6xakYvYNHAYfyewZdyM2oS7+qFRov+/t7rTpiX52MrBn8wVGr8FT:Xt2iwnwjEvY9FWopovgxdiXXIB8F

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5976	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5976	AUDIODG.EXE

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\ASEAG Facelift.rar"
1⤵
PID:2388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3300.8.1518202209\2128695913" -childID 7 -isForBrowser -prefsHandle 1548 -prefMapHandle 1544 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5fd1042-46e6-4dc8-a2df-fa3303c30afe} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" 2772 1c4c5388758 tab
1⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4164 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
1⤵
PID:5200

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3300.9.476552026\1648033776" -childID 8 -isForBrowser -prefsHandle 5572 -prefMapHandle 5612 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {86f48159-87f9-4413-9368-d1a116083fb1} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" 4584 1c4b315f558 tab
1⤵
PID:5488

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3300.10.222260973\1226872765" -parentBuildID 20221007134813 -prefsHandle 5144 -prefMapHandle 5048 -prefsLen 26725 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb905b07-0ee2-4120-a864-8772a8bdab97} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" 5532 1c4b315fe58 rdd
1⤵
PID:5632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3300.11.1721916409\1658368691" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5360 -prefMapHandle 5144 -prefsLen 26725 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {18c1673a-d4b8-4fe1-bd81-de0dfd1d14dc} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" 5352 1c4c1fe1958 utility
1⤵
PID:5688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3300.12.142533478\630945964" -childID 9 -isForBrowser -prefsHandle 5936 -prefMapHandle 5940 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1060 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9f1bced-55dd-41af-ac95-e56f68a9880e} 3300 "\\.\pipe\gecko-crash-server-pipe.3300" 6044 1c4b316c758 tab
1⤵
PID:5696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5976