e4642f6ecf8e2fd74dab5f966f6e7cac8cb0435c15dbe24ce8ac7e96708ca550 | Triage

Analysis

max time kernel
122s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 02:13

Sharing

Report Analysis Logs

General

Target

clash-meta.exe
Size

28.1MB
MD5

f64dc3b8fbe0f8195acfdf144061f471
SHA1

99da00a5e40cf1b6501329e2d05b10cce4571271
SHA256

dff5634f57856309e141f5420fa18b586a2d9e6bee5c4abbc8605ea5cf2b5716
SHA512

5a58de453a3f8d7a144fa1982c01c4a011794d4c98992c123c9b2809b59013a3b55b5893ed02c20410f33f7c2100cc36e91a59176ea71b43b8c17f68bdc745c9
SSDEEP

196608:9OX08B8+gEjLi3TWd57Tco6eW0zAUDkDyIAEZw:9OX7B8+ZLi3TWTHDI0vI6

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	clash-meta.exe

C:\Users\Admin\AppData\Local\Temp\clash-meta.exe
"C:\Users\Admin\AppData\Local\Temp\clash-meta.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4548,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
1⤵
PID:2360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads