f9ff859f39a9e54d733f9c3da77a0c42a4f9c6c53eccccfd7e874b8b5018ec96

Analysis

max time kernel
63s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 15:15

Target

Setup (password is THEPIRATEBAY007).zip
Size

5.1MB
MD5

5a7b05af6be77d411d38e4b9603de6fb
SHA1

890c2441287979341aea951ff1dd0e4e692493bf
SHA256

f9ff859f39a9e54d733f9c3da77a0c42a4f9c6c53eccccfd7e874b8b5018ec96
SHA512

ff24593ff5703675fd41c53acb35e6e36cf33baa660e23a005287eab482c6e79a0cd922efb2b82a6cdec3b8b425f6aeb37f71340b0cbca6ecc2f70475b4c3b2e
SSDEEP

98304:Qay8P3DkDOgkjEBA43Or6uDfilxC0v+3ECjIir05+JKe5G6tZTaD027+mo:Qay8/6vDBAuOr6kYp+tEK6eKe5GoZF2k

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2372	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2372	AUDIODG.EXE
Token: 33	2372	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2372	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Setup (password is THEPIRATEBAY007).zip"
1⤵
PID:2304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2372