b9b63aae4c2f77914dd989f56c14a901de3eaf425a6f6049406fbcac15f6ea62 | Triage

Analysis

max time kernel
268s
max time network
270s
platform
windows7_x64
resource
win7v20210410
submitted
06-08-2021 20:49

Sharing

Report Analysis Logs

General

Target

b9b63aae4c2f77914dd989f56c14a901de3eaf425a6f6049406fbcac15f6ea62.bin.sample.exe
Size

889KB
MD5

ad57ee14ca62c7ec75f7b6a997bebe12
SHA1

32612dc919f38201d8d118c3c2edddcf11a88674
SHA256

b9b63aae4c2f77914dd989f56c14a901de3eaf425a6f6049406fbcac15f6ea62
SHA512

98cb464e9e5a1d47fa0872959f01da10dc200c0e0540c500a28fe4543b775a87febe78c1aead05d3d9ea4a59d0722de250c8a34e5a1c76e3c0ff4c22e9cd2818

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	964	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	964	AUDIODG.EXE
Token: 33	964	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	964	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\b9b63aae4c2f77914dd989f56c14a901de3eaf425a6f6049406fbcac15f6ea62.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\b9b63aae4c2f77914dd989f56c14a901de3eaf425a6f6049406fbcac15f6ea62.bin.sample.exe"
1⤵
PID:1676

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x520
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:964

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-61-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download
memory/1676-60-0x0000000075971000-0x0000000075973000-memory.dmp

Filesize
8KB

Download