c5fe23c626413a18cba8fb4ea93df81529c85f470577fb9c2336d6b692689d9d | Triage

Resubmissions

22/11/2021, 17:56

211122-wjfpbagegn 10

30/06/2021, 07:52

210630-8c1wf6lw12 1

Analysis

max time kernel
23s
max time network
38s
platform
windows7_x64
resource
win7v20210410
submitted
30/06/2021, 07:52

Sharing

Report Analysis Logs

General

Target

c5fe23c626413a18cba8fb4ea93df81529c85f470577fb9c2336d6b692689d9d.exe
Size

2.5MB
MD5

34c3a4538e89e2bc7cd66b01b6b21ffb
SHA1

e3e8e28a70cdfa2164ece51ff377879a5151abdf
SHA256

c5fe23c626413a18cba8fb4ea93df81529c85f470577fb9c2336d6b692689d9d
SHA512

4cb4ba44ee885e1129b2955f9b0b2c752fd6fa73449c0c788a640e5219df7178cf70b7d06c0dc93369c07c9775ec02a9ce0fa090b34e05718776b0d1bc045bf9

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1152	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1152	AUDIODG.EXE
Token: 33	1152	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1152	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\c5fe23c626413a18cba8fb4ea93df81529c85f470577fb9c2336d6b692689d9d.exe
"C:\Users\Admin\AppData\Local\Temp\c5fe23c626413a18cba8fb4ea93df81529c85f470577fb9c2336d6b692689d9d.exe"
1⤵
PID:1656

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1272

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-60-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download