eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
274s
max time network
402s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-05-2023 19:14

Sharing

Target

trojan-leaks-main/cleansaturn.exe
Size

3.8MB
MD5

0f597e254135a708137a52470943316c
SHA1

86240613459d76fff43d9995f73c97f75ee680c1
SHA256

8763150d50e887141961f8c027acf92d5698e8e925cc5e76515d6d8fe330cb26
SHA512

408fe3bd85921cdf5576caa55e28213849c07340817c33605a68fa3da72ae512c0ac710b3a3cb4cbff44c5f64cfb0715034604a5de7bf9c5b6adce4919a2f6eb
SSDEEP

24576:QZ+4JwLcEVrX0VlkxDXMluVGOVCuaYE2IrUOUOqpUKKskz22ETGKJ8QeKzG+9eX:QZoLpXVxgKVCurqZJqhKskzLgGKp5e

Score

1^/10

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

cleansaturn.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	392	cleansaturn.exe
Token: 33	1560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1560	AUDIODG.EXE
Token: 33	1560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1560	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\cleansaturn.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\cleansaturn.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x574
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560

memory/392-54-0x0000000000E70000-0x000000000125B000-memory.dmp

Filesize
3.9MB

Download
memory/392-55-0x0000000000E70000-0x000000000125B000-memory.dmp

Filesize
3.9MB

Download