6927cb7245652a3b66f1a4517189c7cd08056875e09e267a29fe13f1d3bd4d1d

Analysis

max time kernel
300s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 22:32

Target
bad_apple (1).exe
Size 4.8MB
Sample240602-2f7xaahd8s
SHA256 6927cb7245652a3b66f1a4517189c7cd08056875e09e267a29fe13f1d3bd4d1d
MD5 6a022e937a774f6da038da4634b0fc40
SHA1 f204d69f3a78629a85f10bd7d2768b6fc3cbd7db
SHA512 752643d0bc50dd82d7cb82dd8e7acea72859a1f57eff9635fcac0950e73bc2fda1228e8e1405a6cc92ea364f8026e24f4fb88d55f5e92bfe82214dffbe76ca4d
SSDEEP 98304:a8/kJbJDGSdmWaeGzkbqrR7uO3kHQHgHCPfF72yt+7o7W9XXn7z8:a8/k3DGc6QqrZHgHC3LtvS9Hn7
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1652	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1652	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\bad_apple (1).exe
"C:\Users\Admin\AppData\Local\Temp\bad_apple (1).exe"
1⤵
PID:4188

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652