458134e62f193e358984f184ddbd59923ab0387db66c16888dd5996e5e13365c | Triage

Analysis

max time kernel
66s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/08/2024, 18:07

Sharing

Report Analysis Logs

General

Target

SoundLink+.exe
Size

147.0MB
MD5

f0781c8e603e507f168087bedf0dc7ee
SHA1

b34a77ee9d58bab5b2e09889fec2325402a12295
SHA256

e8ae99632b77e8e091bcf9fd3fb3fd62fd5a9bc6bde5756401dfc4fac2f67514
SHA512

723c0dd30a34c911fc8329fe00cbe0c35d2ade22bd301978f776ad8946776920a9fcf31b17cdd0b5cfc5c967c2fda4b1a34e99417742784d6a596035e2affc98
SSDEEP

786432:zPpOizpjOOAcbfWbkQshHSYajxMUbks7GQ+3HDv1++8J:zPpTzpjOVcLWbGNaksqQ+3Hwh

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	SoundLink+.exe

C:\Users\Admin\AppData\Local\Temp\SoundLink+.exe
"C:\Users\Admin\AppData\Local\Temp\SoundLink+.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1284,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
1⤵
PID:4596

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads