c26c8b1d0fe171032f45859d3e07892d8fc73b24fe3356afe635f76e9135c413 | Triage

Analysis

max time kernel
138s
max time network
59s
platform
windows7_x64
resource
win7v20201028
submitted
10-03-2021 12:41

Sharing

Report Analysis Logs

General

Target

EA Games Generic Multi Keygen 214 - By FFF.exe
Size

194KB
MD5

0d111e1ee971736c8eb0c7b1bc0c2cf9
SHA1

1807e0f2317bb9d2d315db0063e631cc51e20b87
SHA256

4cb918bdd53fd77c9b2ccaa34f56b7f24c628ae95be9770c7cd829cbc415be3b
SHA512

9a075f3d00c85e57d2a9bc6072bf78a19dd3a00a88a3f5b7bb99b6e8f2f02f2e39d42158905191364bb7cd392abd37d7fe6a4da03848caa14c55af185d910b10

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

EA Games Generic Multi Keygen 214 - By FFF.exe

pid process

1616 EA Games Generic Multi Keygen 214 - By FFF.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1140	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1140	AUDIODG.EXE
Token: 33	1140	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1140	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\EA Games Generic Multi Keygen 214 - By FFF.exe
"C:\Users\Admin\AppData\Local\Temp\EA Games Generic Multi Keygen 214 - By FFF.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1616

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-2-0x00000000765A1000-0x00000000765A3000-memory.dmp

Filesize
8KB

Download
memory/1616-3-0x0000000000240000-0x0000000000243000-memory.dmp

Filesize
12KB

Download