0cb3f1f50cc20bed39529127ff53820b3becc3a97dadc934d38ff4ea15189162 | Triage

Analysis

max time kernel
41s
max time network
31s
platform
windows7_x64
resource
win7v20210410
submitted
26-05-2021 11:52

Sharing

Report Analysis Logs

General

Target

Pindersoft.ASL.Logbook.1.2.keygen.by.ACME.exe
Size

5.6MB
MD5

3b15a5ba0c59d8dca729df14f9c47f9f
SHA1

391298185efc7730aed2b3d5047baa6d661a327c
SHA256

e43cd9cbc1433581660f7d364b4d9f8040f21f8ff43476f274b31cedf7029adc
SHA512

3452026cecccc3baa04e49e279efffd13080fbe6ed1d0e9c0c0ee25f898c56c0b6f5ae6cf3f38486768bf6949cd779402d3ff7b2f11332252593a1a4d9721c98

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	240	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	240	AUDIODG.EXE
Token: 33	240	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	240	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Pindersoft.ASL.Logbook.1.2.keygen.by.ACME.exe
"C:\Users\Admin\AppData\Local\Temp\Pindersoft.ASL.Logbook.1.2.keygen.by.ACME.exe"
1⤵
PID:1360

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5bc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:240

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-61-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Filesize
8KB

Download
memory/316-62-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download
memory/1360-60-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download