87fa71a870cb79d9e93d76e3dbc7a27325e1ce263f15894b273e12d3409cdbcb | Triage

Analysis

max time kernel
152s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Keygen.exe
Size

197KB
MD5

e31a7e3925a29dcbb1dd1da09e29009d
SHA1

588a84f01319b0953bf4d8f5dd0af12d94589c25
SHA256

e0555500aca0c2d9d50d18062652983591f7d8b385317a516d847c66d298e9cd
SHA512

04a9c6eda3428f55280447ce836de461501cdfa00aad90438584454fa4c1ae7826099494f5c45649fb41ad3610063ed0952cd871f7b2ea47e7da148028929ef2
SSDEEP

3072:UIvCjMhDFGC0DOV9xpcdn7dC+XttMCZATs4F3tZqiNKJG8/FiB88WMz5PVBEZx21:UtURG70SMC4s41q9AER8tax

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/1672-132-0x0000000000400000-0x00000000004B1000-memory.dmp	upx

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4448	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4448	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Keygen.exe
"C:\Users\Admin\AppData\Local\Temp\Keygen.exe"
1⤵
PID:1672

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x33c 0x3d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-132-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download