a913bf3bee70654502bad100f70c9a117dc7c9cc3cc0c673c63161ae232b7499 | Triage

Analysis

max time kernel
46s
max time network
71s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26/11/2022, 23:17

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

98ME_20011_2kXP_20024/DRemover98_2K.exe
Size

132KB
MD5

d2e58250056996fec0023e8ef08c8563
SHA1

eef0d0d3f82a89c518e10b77f8729dcc0fec426b
SHA256

00e8ee665b67bc983811d1d0a83eecbf8b131501ac701c7cef37e9491ddf8e8a
SHA512

811031b7f0b14c4fcf5334426f27fcdbeca8b8e2d12935b8fc97870f5e4daf8df8254ec922e4f44a258a5664757e7d8abf503eb9d7bf00e6b335fd4e714b2e78
SSDEEP

3072:1a+ANS5hpxJQ+8QR+8lof+H8LoKe4/hQb:1a+US5hpNrjC+cL/

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\ser2pl.sys	DRemover98_2K.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1384	DRemover98_2K.exe
Token: 33	1980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1980	AUDIODG.EXE
Token: 33	1980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1980	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1384	DRemover98_2K.exe
1384	DRemover98_2K.exe

C:\Users\Admin\AppData\Local\Temp\98ME_20011_2kXP_20024\DRemover98_2K.exe
"C:\Users\Admin\AppData\Local\Temp\98ME_20011_2kXP_20024\DRemover98_2K.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1384

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1736

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x558
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1576

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1736-54-0x000007FEFC481000-0x000007FEFC483000-memory.dmp

Filesize
8KB

Download