eadaf26df948f0fd541f297e2f0bad435aa4bee5c97e4324ad767dacca77e29d

max time kernel
257s
max time network
408s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
09-05-2023 19:14

Sharing

Target

trojan-leaks-main/Suffocate-safety.exe
Size

592KB
MD5

a66a634984d867b4e7c6c94d3c3b5a5e
SHA1

aae20c9ea86f09cf2a38494af54bc42f93a05d8b
SHA256

1a0bc18ff66a0fcb2aaed91ca23b5cffff0c3ef45e5b9a30b0ccb3ad60b64c2d
SHA512

ec9a8c706a9488870ec39366bea3ca538628579896c0fbb7d532bc6c4d197354c44822dc3f5e910dbe6ec13b581312dd30aa360a0b61d6934865789687591244
SSDEEP

6144:rDkQaeZDEqsErE0jAC1drT1/B4y3VCHMHW98MNz7tLpu3Jdl18uUkUT5oOY2di:rIje5h1dH1/Gy3YHM29zEPtQmONw

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	872	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	872	AUDIODG.EXE
Token: 33	872	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	872	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Suffocate-safety.exe
"C:\Users\Admin\AppData\Local\Temp\trojan-leaks-main\Suffocate-safety.exe"
1⤵
PID:1992

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:872

memory/1992-54-0x0000000001360000-0x00000000013FA000-memory.dmp

Filesize
616KB

Download
memory/1992-55-0x000000001AA00000-0x000000001AA80000-memory.dmp

Filesize
512KB

Download
memory/1992-56-0x000000001AA00000-0x000000001AA80000-memory.dmp

Filesize
512KB

Download
memory/1992-57-0x000000001AA00000-0x000000001AA80000-memory.dmp

Filesize
512KB

Download
memory/1992-58-0x000000001AA00000-0x000000001AA80000-memory.dmp

Filesize
512KB

Download