e2dca85ba15366a41846b1152329ad9c7abc8b410b5ee51d00b812c1d1eae761

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

?????10?/?????.exe
Size

1.4MB
MD5

06c7bb0ae19c1da9066a41d1466c19fb
SHA1

8d2f19b96c4c29fe16626c595fc22cf78be827c9
SHA256

2db99fd17f60f09535435db87d7ac89a5ce36057272cce14bf70fe54f81ad056
SHA512

1b732e8a83735671e3985b45e55724eff6da3179a890a4c1aee57c1130117ad60324ac8107634a3030af2d9591fbf7534e1eeca80ea45f4517ce014efc739a27
SSDEEP

6144:JSGVR4r4ICts0uMsTB0/yn3WVQZLtXSDsYiOP9SeFI1KY7ipmXXJ57Defu5mLQ+t:YGVCcM3B3EVPFu5mL

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral4/memory/2828-7-0x0000000002EE0000-0x00000000030AC000-memory.dmp	upx
behavioral4/memory/2828-15-0x0000000002EE0000-0x00000000030AC000-memory.dmp	upx
behavioral4/memory/2828-6-0x0000000002EE0000-0x00000000030AC000-memory.dmp	upx
behavioral4/memory/2828-3-0x0000000002EE0000-0x00000000030AC000-memory.dmp	upx
behavioral4/memory/2828-28-0x0000000002EE0000-0x00000000030AC000-memory.dmp	upx
behavioral4/memory/2828-32-0x0000000002EE0000-0x00000000030AC000-memory.dmp	upx
behavioral4/memory/2828-33-0x0000000002EE0000-0x00000000030AC000-memory.dmp	upx

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

_____.exe

pid	process
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe
2828	_____.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE_____.exe

description pid process

Token: 33 4740 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 4740 AUDIODG.EXE
Token: 33 2828 _____.exe
Token: SeIncBasePriorityPrivilege 2828 _____.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

_____.exe

pid process

2828 _____.exe
2828 _____.exe
2828 _____.exe
2828 _____.exe

description	pid	process
Token: 33	4740	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4740	AUDIODG.EXE
Token: 33	2828	_____.exe
Token: SeIncBasePriorityPrivilege	2828	_____.exe

C:\Users\Admin\AppData\Local\Temp\_____10_\_____.exe
"C:\Users\Admin\AppData\Local\Temp\_____10_\_____.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2828

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:4928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2828-0-0x00000000756F0000-0x00000000758A6000-memory.dmp

Filesize
1.7MB

Download
memory/2828-7-0x0000000002EE0000-0x00000000030AC000-memory.dmp

Filesize
1.8MB

Download
memory/2828-11-0x0000000076030000-0x0000000076120000-memory.dmp

Filesize
960KB

Download
memory/2828-12-0x0000000076030000-0x0000000076120000-memory.dmp

Filesize
960KB

Download
memory/2828-13-0x0000000076030000-0x0000000076120000-memory.dmp

Filesize
960KB

Download
memory/2828-14-0x0000000076030000-0x0000000076120000-memory.dmp

Filesize
960KB

Download
memory/2828-10-0x0000000076030000-0x0000000076120000-memory.dmp

Filesize
960KB

Download
memory/2828-15-0x0000000002EE0000-0x00000000030AC000-memory.dmp

Filesize
1.8MB

Download
memory/2828-9-0x0000000076030000-0x0000000076120000-memory.dmp

Filesize
960KB

Download
memory/2828-8-0x0000000076050000-0x0000000076051000-memory.dmp

Filesize
4KB

Download
memory/2828-6-0x0000000002EE0000-0x00000000030AC000-memory.dmp

Filesize
1.8MB

Download
memory/2828-3-0x0000000002EE0000-0x00000000030AC000-memory.dmp

Filesize
1.8MB

Download
memory/2828-16-0x0000000034D90000-0x0000000034DA0000-memory.dmp

Filesize
64KB

Download
memory/2828-27-0x00000000756F0000-0x00000000758A6000-memory.dmp

Filesize
1.7MB

Download
memory/2828-28-0x0000000002EE0000-0x00000000030AC000-memory.dmp

Filesize
1.8MB

Download
memory/2828-29-0x0000000076030000-0x0000000076120000-memory.dmp

Filesize
960KB

Download
memory/2828-30-0x0000000076030000-0x0000000076120000-memory.dmp

Filesize
960KB

Download
memory/2828-31-0x0000000076030000-0x0000000076120000-memory.dmp

Filesize
960KB

Download
memory/2828-32-0x0000000002EE0000-0x00000000030AC000-memory.dmp

Filesize
1.8MB

Download
memory/2828-33-0x0000000002EE0000-0x00000000030AC000-memory.dmp

Filesize
1.8MB

Download