9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900 | Triage

Analysis

max time kernel
154s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01-06-2022 23:29

Sharing

Report Analysis Logs

General

Target

9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900.exe
Size

1.9MB
MD5

f901c645188f9c80afa8f49174f065ce
SHA1

272bc9298b394760d68e14dcf479233800a098a9
SHA256

9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900
SHA512

8de72f93ab1a507a08a283da4e8948756364d45fa70e8332da424b27a9cb8d6c3ad93cb5062343a6cc8cf0009d7c7d3fef8e209f99fedbe02b7d2d5c010c291c

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2848	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2848	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900.exe
"C:\Users\Admin\AppData\Local\Temp\9385d7e149bcda79e5a4291ad422c160be8297d029d04ee04c50240fe53aa900.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1912

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x524 0x520
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads