cbd8811105a4dac477788ae8a549cd3e8de5a155ea9eb8d03cf0069e58a62626 | Triage

Analysis

max time kernel
57s
max time network
62s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
10-04-2023 09:41

Sharing

Report Analysis Logs

General

Target

game_botter/chromedriver.exe
Size

10.2MB
MD5

7ecc26c832c07b00d32e0b9c9360c3a7
SHA1

37f69d14425297132beeffdf705fd61d981086a7
SHA256

37c78987cd4bd112f15a22e22cf42ecf315dc4179b4ac8332e3b0a9d167a4d91
SHA512

7e0e6bba05f2dd063fe4cf256a1dce5de7ae88eae3d80059c2631f75b0febbb70c830872cbdaca75cbc7e960bb2f4b6d8d37efadab3a98fbc547d3bf3b6a0fd0
SSDEEP

196608:U0TLrXoGaJINYI5lEZSmdXhnDaATPz/VDnV:U030GaUzEsKxnGATPz/VDV

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1100	AUDIODG.EXE
Token: 33	1100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1100	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\game_botter\chromedriver.exe
"C:\Users\Admin\AppData\Local\Temp\game_botter\chromedriver.exe"
1⤵
PID:1520

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:568

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads