b42c54ae8240dd69c9253fa18b9e11d752532a10746e7e11c0b79bc47df160e1 | Triage

Analysis

max time kernel
37s
max time network
29s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
31-03-2023 20:00

Sharing

Report Analysis Logs

General

Target

Kingdom Rush Vengeance.exe
Size

11.3MB
MD5

725f79a088c663bea0d4deb433b38081
SHA1

ed482631be0031222eb77e114d143578ffac73a5
SHA256

b42c54ae8240dd69c9253fa18b9e11d752532a10746e7e11c0b79bc47df160e1
SHA512

3b5f48185c408933c365cd8da007f4fc2e623cef35f8777906baa26f0a497cb0f0a2a2522ba075f6366a5a2b17753590196d796ccab5ff7e5b9d7b3a9072cc64
SSDEEP

196608:JrqhpbK9zLu1hJt9pmm6EZC60BfxYdRd7Ku:JehZK9zLu1hJt9pmm6EZwBpu

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	580	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	580	AUDIODG.EXE
Token: 33	580	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	580	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Kingdom Rush Vengeance.exe
"C:\Users\Admin\AppData\Local\Temp\Kingdom Rush Vengeance.exe"
1⤵
PID:1976

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1632

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:580

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...