fd5c50ba77cb29189c17400f867995051978172aeb3079a264305375430b7b12 | Triage

Analysis

max time kernel
199s
max time network
156s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
10/10/2023, 20:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

SMM-WE.exe
Size

26.4MB
MD5

1ddb36a7e4cf4d1941b1eff14dc17965
SHA1

1b432fc218dd23fac2b551b0ef321c97bfcae351
SHA256

a224134d226fe1fad21893b7f91e929c6fb1fbda6a3a5dff66c8f474050cd612
SHA512

8b5d8360c34d676bb9e20ea3e4766fbb48154020d35c4e98287b62df095080be7ad83014cea7e180d2b6f5c5769ecc1d28571082728bfc41870530094cf1b9b8
SSDEEP

393216:o3Axmkia89nzvyi9M48mI8w4r0w4Ifrs6L5hp6Pcgdcs:oJV5r0V4pmcgdcs

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2508	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2508	AUDIODG.EXE
Token: 33	2508	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2508	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2716	SMM-WE.exe
2716	SMM-WE.exe

C:\Users\Admin\AppData\Local\Temp\SMM-WE.exe
"C:\Users\Admin\AppData\Local\Temp\SMM-WE.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2716

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x56c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2716-14-0x000007FFFFF90000-0x000007FFFFFA0000-memory.dmp

Filesize
64KB

Download