cae0dec7f208e12edb1473c24204df2a7156062dabd1c69e9375798987d59a1c | Triage

Analysis

max time kernel
130s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 13:11

Sharing

Report Analysis Logs

General

Target

qwingraph.exe
Size

473KB
MD5

3fb5202f388ca3ada3ab12fed5d7207e
SHA1

4699eaab910b858086af99b907578ab4cc935dd9
SHA256

287aba535fc5a304fc2cabbcabbe09f503bd80d7321ca0e45042e6229fce673a
SHA512

e9698d7a6e1030c549325157e9e04a9c5efa453aaae753e92d2cec270fa57228b8ad069987275b56f8442cd68f8b6fc3245853c288ff74609bd20f823797344f
SSDEEP

12288:XgSnO4ZjPUwXz2qDfMjZfCIKuh/42KLJ46:XgV4BNXiqDfMjZfCIKuS9L

Score

1^/10

Malware Config

Signatures

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2680	qwingraph.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2732	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2732	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2680	qwingraph.exe

C:\Users\Admin\AppData\Local\Temp\qwingraph.exe
"C:\Users\Admin\AppData\Local\Temp\qwingraph.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-1-0x000001D4EA920000-0x000001D4EA930000-memory.dmp

Filesize
64KB

Download
memory/2680-0-0x00007FFCB69E0000-0x00007FFCB6F36000-memory.dmp

Filesize
5.3MB

Download