7eff736e2cd31d11dee6036387cf70e04e56ee99c79b555fa5b1e3b7ad530743 | Triage

Analysis

max time kernel
125s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/10/2022, 13:24

Sharing

Report Analysis Logs

General

Target

三国志Ⅱ--霸王的大陆1.2/霸王的大陆.exe
Size

888KB
MD5

e2c99276e8ed99493489581a8783deeb
SHA1

551e1ad18a1b2b0e6eccb4038b07d211f6af9f87
SHA256

637872a9c3ffddd5f4170dfa196c215b8eb367fd0eb6615ffe001d0f9b25eeda
SHA512

cd3fdbbe3a2f25d9f71e17df081dbb58e324f59887698f3890edfd0dd0952f3cfb315eb53e5dc5c750c6813bff49bb8122748cbee3add0e71713efc1a867e336
SSDEEP

12288:VcVwvzfSz8K5JbAEypyBfLny1UgUdkN5Z4Pg6k83NsAtMOIIF+R:qXgwOPs9+1UCyEOIvR

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1336	霸王的大陆.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1912	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1912	AUDIODG.EXE
Token: 33	1912	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1912	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1336	霸王的大陆.exe
1336	霸王的大陆.exe
1336	霸王的大陆.exe

C:\Users\Admin\AppData\Local\Temp\三国志Ⅱ--霸王的大陆1.2\霸王的大陆.exe
"C:\Users\Admin\AppData\Local\Temp\三国志Ⅱ--霸王的大陆1.2\霸王的大陆.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1336

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x540
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1336-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download