b3c38476f98743aeeb29e7738b98d6fb813208675eba907f2ee694c25fc024cf | Triage

Resubmissions

20-09-2022 21:46

220920-1mzntaaadl 1

20-09-2022 19:14

220920-xx1r3sebh7 3

Analysis

max time kernel
90s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2022 19:14

Sharing

Report Analysis Logs

General

Target

5127E7ED77D4D85420705A114D3B7B970E755F27_decoded.exe
Size

590KB
MD5

d849b4f69e53e5ecca20081d4c057562
SHA1

ee8533ae68727c964055b66057216c765d48f41b
SHA256

a6e6e080ea362fdadcfe656c8bebdab3306097beb458877e57f9003bdcb945bf
SHA512

921b375cc2a263ade62c4c00137134837a27cd72f8f84686446e428832dd2745d58d327953e1039987e9ce237f851b5584056373b5d74bccb1b2dfebd0f902e9
SSDEEP

12288:a310gbgFsdLVQZUZmaNcmw+ErNdoqqG+6Nk:7lrMcrrtk

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1988	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1988	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\5127E7ED77D4D85420705A114D3B7B970E755F27_decoded.exe
"C:\Users\Admin\AppData\Local\Temp\5127E7ED77D4D85420705A114D3B7B970E755F27_decoded.exe"
1⤵
PID:2412

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x42c 0x478
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-132-0x0000000000230000-0x00000000002C8000-memory.dmp

Filesize
608KB

Download
memory/2412-133-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download
memory/2412-134-0x00007FF833AC0000-0x00007FF834581000-memory.dmp

Filesize
10.8MB

Download