eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
139s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2023 19:10

Sharing

Target

trojan-leaks-main/Suffocate-safety.exe
Size

592KB
MD5

a66a634984d867b4e7c6c94d3c3b5a5e
SHA1

aae20c9ea86f09cf2a38494af54bc42f93a05d8b
SHA256

1a0bc18ff66a0fcb2aaed91ca23b5cffff0c3ef45e5b9a30b0ccb3ad60b64c2d
SHA512

ec9a8c706a9488870ec39366bea3ca538628579896c0fbb7d532bc6c4d197354c44822dc3f5e910dbe6ec13b581312dd30aa360a0b61d6934865789687591244
SSDEEP

6144:rDkQaeZDEqsErE0jAC1drT1/B4y3VCHMHW98MNz7tLpu3Jdl18uUkUT5oOY2di:rIje5h1dH1/Gy3YHM29zEPtQmONw

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 3864 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 3864 AUDIODG.EXE

description	pid	process
Token: 33	3864	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3864	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Suffocate-safety.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Suffocate-safety.exe"
1⤵
PID:3280

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x304 0x308
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3864

memory/3280-133-0x00000000002A0000-0x000000000033A000-memory.dmp

Filesize
616KB

Download
memory/3280-134-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download
memory/3280-135-0x0000000002590000-0x00000000025A0000-memory.dmp

Filesize
64KB

Download