90c069f975f125e308ec1da2e0789da2e963d277186e5ace1348f77aba445650 | Triage

Analysis

max time kernel
10s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/08/2024, 16:47

Sharing

Report Analysis Logs

General

Target

FluxTeam.zip
Size

34.3MB
MD5

eaa845a8cabd9e13151786580b122e99
SHA1

460d005a4cac062a86552977ff6b7bb2f95c02e2
SHA256

90c069f975f125e308ec1da2e0789da2e963d277186e5ace1348f77aba445650
SHA512

c5a39b3b4b1462e537a811738438a3397005da0620e56474165246ead33c0663c571a3f35ad632f79baa62ed2bf54ffb08ebf53d8a48d269339c7e6c2fb5d007
SSDEEP

786432:CjyaAFZvok3gA/rbFy0Uf0dmAPNoDAyD8nJ3dnXqEOHsy/TZ:C2a+ZvosgA/Ny0Uz0oDAC8RdIHfrZ

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2320	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2320	AUDIODG.EXE
Token: 33	2320	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2320	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\FluxTeam.zip
1⤵
PID:2552

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2708

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads