bfe30493e06806cdb3081f03dc17f09b3e14434a765389f92eeace69cb16a77c

Resubmissions

07/11/2021, 17:39

22/10/2021, 07:24

Target

Ransomware TESTER.exe
Size

3.4MB
MD5

73e648b2a4b5694be7fe6a0384e911c4
SHA1

48d275d6e9c7578f283f76ea0355bf0c25313004
SHA256

bfe30493e06806cdb3081f03dc17f09b3e14434a765389f92eeace69cb16a77c
SHA512

85548a6a1f97fa4e3c61775204d7cbec1b95836175889e28c6f16a333e18a48b393f14e60dd29fd46e8c75d1261a06d8ffe97622b89febe94a47ac9f73805651

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1872	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1872	AUDIODG.EXE
Token: 33	1872	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1872	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
976	Ransomware TESTER.exe

C:\Users\Admin\AppData\Local\Temp\Ransomware TESTER.exe
"C:\Users\Admin\AppData\Local\Temp\Ransomware TESTER.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:976

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872

memory/976-55-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/976-57-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/976-58-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/976-59-0x0000000004B45000-0x0000000004B56000-memory.dmp

Filesize
68KB

Download
memory/976-60-0x0000000004B56000-0x0000000004B57000-memory.dmp

Filesize
4KB

Download