71ca8d8f691621cddb23db73cb9c2d7acc0c175036de3546db9d29f3ab724e41

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06-07-2024 18:46

Target

Setup.zip
Size

75.5MB
MD5

4eac80804f82ffa5f96d5cd4c8ed8c6d
SHA1

302ebd812653541dd10741ed409353a85159c56b
SHA256

71ca8d8f691621cddb23db73cb9c2d7acc0c175036de3546db9d29f3ab724e41
SHA512

6d6428f78ae1aa9ab75f9b496ab2bb9a42f7813b553c41893a69908b2c7745273f7db07262448f55b11e708d9a5f3573eb42b886ebadb41540950ed116c123d0
SSDEEP

1572864:3NX+TJIEQmKkYj3C6ziMbvMlXzn/BAlIR+6vji6ntLGcSwQ7YBthjHqvki4:3R4JInmJO34MbKjn/1WS2j7YBth8ki4

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2672	AUDIODG.EXE
Token: 33	2672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2672	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Setup.zip
1⤵
PID:2840

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672