6780a41b94dc68fca68623d46dd24b370efd82a92da3cd743524c183172a2303 | Triage

Analysis

max time kernel
78s
max time network
88s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 20:41

Sharing

Report Analysis Logs

General

Target

Solًara.zip
Size

57.4MB
MD5

a19fc9ec23f63429f63254074b323d88
SHA1

31f317e6ecb7ef778cc408c32f3a5a5e71128a8d
SHA256

2ef19e4d957e178e7646086eabab9b9562804e6260804ed55cb688f646093446
SHA512

676df16cffef52b0a162ba3553bb6cc24c7adae24bc0160202650ccee8186803a408e5ec9488dcb9a40aeeef27d11867389a9076869304d0662c7812d8c132be
SSDEEP

1572864:2fWdediqqpDaDYFgwBmjCmN4lSe3Xu3tY7iqW/:EdhqpDq0bSxe3XetYs/

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	920	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	920	AUDIODG.EXE
Token: 33	920	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	920	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Solًara.zip
1⤵
PID:2732

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:920

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads