7dd0d8c33379f84e3e23d29340051465197735d7fc1e5debf9bf5a6b4f220484 | Triage

Analysis

max time kernel
57s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2022, 16:02

Sharing

Report Analysis Logs

General

Target

f.exe
Size

4.7MB
MD5

bb4a5266324a3dee6cb4b06d03f3f3e9
SHA1

9f08e998088faa8386928c4a4dcbca5214b4f422
SHA256

7dd0d8c33379f84e3e23d29340051465197735d7fc1e5debf9bf5a6b4f220484
SHA512

18fc7355ea1182096aac1786369e07b0828346dcb68405082089c2498fbaffce32563cb666600e6d50ea4c0810ffaa8bbbca014e4b5fd14a0c6100483885ad66
SSDEEP

98304:ceGLANOwhDMNyINf+e6QQeyATAWJc9KKZBFALYiTtG2W:QLANOwZMNygxQeBs9KaBFuYi

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3908	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3908	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\f.exe
"C:\Users\Admin\AppData\Local\Temp\f.exe"
1⤵
PID:3716

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc 0x434
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3716-132-0x000001F0D5F30000-0x000001F0D63E8000-memory.dmp

Filesize
4.7MB

Download
memory/3716-133-0x00007FF80C090000-0x00007FF80CB51000-memory.dmp

Filesize
10.8MB

Download
memory/3716-134-0x00007FF80C090000-0x00007FF80CB51000-memory.dmp

Filesize
10.8MB

Download