e86224ab93aff0188e5deb93f041cc4ee9d47b65e4d51d61279982901b9800cc

Analysis

max time kernel
1793s
max time network
1800s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 05:14

Target
Tool_Files/ADB Tools.cmd
Size 10KB
Sample240615-fxc8cazcqa
SHA256 634e2bada6c6b7fb5a1e91342f816fbba994de49f95c98d8f732de0fede4c973
MD5 668bb0127ca2ace980272070018f730f
SHA1 7e52565de161efca60d4fad1efa2d684fe0da013
SHA512 c92938313ca1047f6a96b1e4b8d4534bf5aeb35508cdfd2fdbf3028b233a952d78112a61fb520960db433ef585ce7c411792e1b4ebc2d283f5c855b5d00b6ffb
SSDEEP 96:Pn3o3o3o3opmy5o8o3o3o3o3pA5kpxL9ef2aVcIxc3wVcd8wPKsFpYO4F8dfvXsG:1a5kpZ9Yf+Iig+d8A4kXsoZ
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4564	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4564	AUDIODG.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 2688	4308	cmd.exe	88
PID 4308 wrote to memory of 2688	4308	cmd.exe	88
PID 4308 wrote to memory of 3420	4308	cmd.exe	89
PID 4308 wrote to memory of 3420	4308	cmd.exe	89
PID 4308 wrote to memory of 2708	4308	cmd.exe	90
PID 4308 wrote to memory of 2708	4308	cmd.exe	90
PID 4308 wrote to memory of 3928	4308	cmd.exe	91
PID 4308 wrote to memory of 3928	4308	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Tool_Files\ADB Tools.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"
  2⤵
  PID:2688
- C:\Windows\system32\findstr.exe
  findstr /v /a:0a /R "^$" " BELOW IS YOUR DEVICE STATUS" nul
  2⤵
  PID:3420
- C:\Windows\system32\findstr.exe
  findstr /v /a:0a /R "^$" "----------------------------------------------------------------------------------------------------" nul
  2⤵
  PID:2708
- C:\Windows\system32\findstr.exe
  findstr /v /a:0a /R "^$" "----------------------------------------------------------------------------------------------------" nul
  2⤵
  PID:3928

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x3fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1012,i,17949988676391029604,13756926835471203788,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
1⤵
PID:2560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4576,i,17949988676391029604,13756926835471203788,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:8
1⤵
PID:712

BELOW IS YOUR DEVICE STATUS

Path C:\Users\Admin\AppData\Local\Temp\Tool_Files\ BELOW IS YOUR DEVICE STATUS
Size 3B
SHA256 3e39ed22dc63246937c4dbbf34ce4fb1cfe6b00de7596b020cad49ae50031351
MD5 df66fa563a2fafdb93cc559deb0a38c4
SHA1 e6666cf8574b0f7a9ae5bccee572f965c2aec9cb
SHA512 34ea05ee75cd840a94526411777868edb293a69867e1fdc2c2e917d278a3d58fcb86afc65142f4b184ce6907f04fb254a86061cfb620f01874b0b454a6f01c18
MD5 SHA1 SHA512

Submit Download