10e51d320044307c4dd8ca1e33984db050fcc07818645598d4cb883f088c8475 | Triage

Analysis

max time kernel
40s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/01/2023, 17:43

Sharing

Report Analysis Logs

General

Target

QPatcher.exe
Size

58KB
MD5

c383153d8022897021b0340e5ed3665b
SHA1

06955321b46c49ddc9ded9d6941e3e4017c32d5e
SHA256

10e51d320044307c4dd8ca1e33984db050fcc07818645598d4cb883f088c8475
SHA512

d9c359a291d8865cf9c74425353dc0add4c6c18e5058dd90c185b4a17f2a41571a685a8dffbc7fb38cd7ffb17487fc4b3e652a3930019bb2a8474e51980c017f
SSDEEP

1536:negITkTI4I/IQ9TIzCilhX3rVqhtTK2cXryg:VITCI4I/b3MpqrFQ+g

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	588	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	588	AUDIODG.EXE
Token: 33	588	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	588	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\QPatcher.exe
"C:\Users\Admin\AppData\Local\Temp\QPatcher.exe"
1⤵
PID:1460

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1112

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x54c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1112-56-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/1460-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1460-55-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download