af600c5c0b48648b878ba5eb43dcaf74dcf021fa31de8718fdcd90adb960d7dd | Triage

Analysis

max time kernel
92s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 22:06

Sharing

Report Analysis Logs

General

Target

AssetStudioGUI.exe
Size

183KB
MD5

75e0e3d26ce43da499e6b7beb81a3b8b
SHA1

134870b562870ed1cd99dc21009412842a897173
SHA256

aba48df497f351a07a394a8aba685defa4aaafb9b1477e135afb9a99ccf9021b
SHA512

972b6fc676e936c2dd7b6d91a8484c9b83110b3d54e6840c5e9562cf89384fed97bb3c5c54d58047fb736931a9d4b230e0316665661e3660196c078d78a03942
SSDEEP

3072:uwLEVbLoEZljy9611VBzEkjqr15MX7aSJ5iGmXSW6lb:uRXy9611VBzwU2SziGmXSf

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

AssetStudioGUI.exe

pid process

1512 AssetStudioGUI.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

AssetStudioGUI.exeAUDIODG.EXE

description pid process

Token: SeDebugPrivilege 1512 AssetStudioGUI.exe
Token: 33 828 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 828 AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\AssetStudioGUI.exe
"C:\Users\Admin\AppData\Local\Temp\AssetStudioGUI.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x4d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1512-0-0x00007FFD5BC7B000-0x00007FFD5BC7C000-memory.dmp

Filesize
4KB

Download
memory/1512-1-0x00007FFD5BC7B000-0x00007FFD5BC7C000-memory.dmp

Filesize
4KB

Download