eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
141s
max time network
188s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
09-05-2023 19:14

Sharing

Target

trojan-leaks-main/Suffocate-safety.exe
Size

592KB
MD5

a66a634984d867b4e7c6c94d3c3b5a5e
SHA1

aae20c9ea86f09cf2a38494af54bc42f93a05d8b
SHA256

1a0bc18ff66a0fcb2aaed91ca23b5cffff0c3ef45e5b9a30b0ccb3ad60b64c2d
SHA512

ec9a8c706a9488870ec39366bea3ca538628579896c0fbb7d532bc6c4d197354c44822dc3f5e910dbe6ec13b581312dd30aa360a0b61d6934865789687591244
SSDEEP

6144:rDkQaeZDEqsErE0jAC1drT1/B4y3VCHMHW98MNz7tLpu3Jdl18uUkUT5oOY2di:rIje5h1dH1/Gy3YHM29zEPtQmONw

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 2068 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 2068 AUDIODG.EXE

description	pid	process
Token: 33	2068	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2068	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Suffocate-safety.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Suffocate-safety.exe"
1⤵
PID:4320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x200
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2068

memory/4320-117-0x0000000000960000-0x00000000009FA000-memory.dmp

Filesize
616KB

Download
memory/4320-118-0x0000000001120000-0x0000000001130000-memory.dmp

Filesize
64KB

Download
memory/4320-121-0x0000000001120000-0x0000000001130000-memory.dmp

Filesize
64KB

Download