b066ac24f918a0a981018c5050808b2095303552f09cce574ef08118667f3276 | Triage

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
22/09/2022, 02:43

Sharing

Report Analysis Logs

General

Target

xf-adesk2012x64.exe
Size

199KB
MD5

2ad744237a1d5ca25b671862cb9961b9
SHA1

082354a70a7643a94e76c581e144b38fbfbbf851
SHA256

b066ac24f918a0a981018c5050808b2095303552f09cce574ef08118667f3276
SHA512

8fa8091d528a53481d2f52f49813821da7b6e1fc63e2523028cf929a25d77fb5854b25c6af7cc05109d03fc059d8328b3be56b019e00fefb83e4b4abb7ba333e
SSDEEP

6144:rvfVN20OokSla3DoW/x0ESExlHfipoSm:rXB7lazoy2E3HqpoSm

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/1944-54-0x0000000000400000-0x00000000004AC000-memory.dmp	upx
behavioral1/memory/1944-55-0x0000000000400000-0x00000000004AC000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1520	AUDIODG.EXE
Token: 33	1520	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1520	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\xf-adesk2012x64.exe
"C:\Users\Admin\AppData\Local\Temp\xf-adesk2012x64.exe"
1⤵
PID:1944

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/1944-55-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download