e2dca85ba15366a41846b1152329ad9c7abc8b410b5ee51d00b812c1d1eae761 | Triage

Analysis

max time kernel
133s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:39

Sharing

Report Analysis Logs

General

Target

?????10?/jianpan.exe
Size

1.8MB
MD5

f80302788d4410439713794efe43779e
SHA1

e9de20c908b0302dd9086b02c587f3535e7feb6d
SHA256

bef66045f3b8757a8cc9f67c4439f4a086749061fc7bc713c00e2bc50f755c95
SHA512

4ea10b9c170b65b057fedb00f2019478efb60fc33b4c0d6ed93309eede3786f40c0142ac8c821fa9fc4fe9232baf6b905cb5bdeb0feb8033a44adad704fef651
SSDEEP

12288:VGVCcb3B3EySK9KIjWKVKKKKmYU6Kv+DOfSyXVHrzYeu5mL2p:YVCYhAvA8vXrLG

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXEjianpan.exe

description pid process

Token: 33 3916 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 3916 AUDIODG.EXE
Token: 33 3920 jianpan.exe
Token: SeIncBasePriorityPrivilege 3920 jianpan.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

jianpan.exe

pid process

3920 jianpan.exe
3920 jianpan.exe
3920 jianpan.exe
3920 jianpan.exe

C:\Users\Admin\AppData\Local\Temp\_____10_\jianpan.exe
"C:\Users\Admin\AppData\Local\Temp\_____10_\jianpan.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3920

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x51c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3920-2-0x00000000354D0000-0x00000000354E0000-memory.dmp

Filesize
64KB

Download