Analysis
-
max time kernel
126s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 10:32
Behavioral task
behavioral1
Sample
PCAppStore.exe
Resource
win7-20240221-en
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
PCAppStore.exe
Resource
win10v2004-20240426-en
1 signatures
150 seconds
General
-
Target
PCAppStore.exe
-
Size
1.9MB
-
MD5
9b9749c12da113c64ec9c6cf511e7936
-
SHA1
faeade745cf2accc5ef659bcfc60614cbe003221
-
SHA256
1004551597e805a2a2a52300fda3faae23cf465d13dd9b999101e953095328e0
-
SHA512
637eb380c94d3ec57bbd4e8ca318c98fd9cf5db014ae4c32343661ae7e31cd055021168de9a3087e4982f9595480a1a9b197804f3b29cb7487af38d59af66b76
-
SSDEEP
49152:pSxL3nvs765SKjcTY/Zwv5dNKc9ts9rCYapij+1blI6:pSxI765SKjc0UtsVCYj4
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2420 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2420 AUDIODG.EXE Token: 33 2420 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2420 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\PCAppStore.exe"C:\Users\Admin\AppData\Local\Temp\PCAppStore.exe"1⤵PID:1936
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2544
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420