4c95f07e2269b31bbc3b577ac37a9f1e5890d475076eac2402b4bd0d2b834b78 | Triage

Analysis

max time kernel
61s
max time network
33s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 17:06

Sharing

Report Analysis Logs

General

Target

calc.zip
Size

196KB
MD5

6868b1bd5697ab72cc644da0fdd6d106
SHA1

d7aa5c5399bd36e95c7021c8154031e1283c70b5
SHA256

4c95f07e2269b31bbc3b577ac37a9f1e5890d475076eac2402b4bd0d2b834b78
SHA512

8c9cc99bd89cc58eb425a4b831460e98daa50ba75b54963169ec4874eeb206279d77023370e27826827d01903d56339ebc620b607e4913e20fc11f756b56108f
SSDEEP

3072:IcE+cOzNKBpqYpiARPv7dBCBF0WYwF4oi24UKMsSrL5rgpJIxPU79HSNxd:C+Z63pi8d4BFLZBiBIlV+79Hc

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2804	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2804	AUDIODG.EXE
Token: 33	2804	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2804	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\calc.zip
1⤵
PID:3056

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5d4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads