8178db02ae1f0522720d8b4a2ea562420a2e51c7641ec7ae8a2f0711169d219b | Triage

Analysis

max time kernel
133s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 05:31

Sharing

Report Analysis Logs

General

Target

08270921eea03fff2bfdc3563f845dff.exe
Size

461KB
MD5

08270921eea03fff2bfdc3563f845dff
SHA1

8b82159c8f798ec8a0ea05a0fd0d0f98cc412cb4
SHA256

8178db02ae1f0522720d8b4a2ea562420a2e51c7641ec7ae8a2f0711169d219b
SHA512

c8acc47861f4fe44cbd542d3d014faf11e214577f6d3cbd6093cab7231f9cac1aaa4416ce3257c790b57e292e2599f32fbadcb1aa0d5044577d598cff074938e
SSDEEP

6144:on+Yk58YbANKKPKv5pCXvJgw00MNvVt7w90Sq:o+YjYbANKK+CfJv

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2936	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2936	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\08270921eea03fff2bfdc3563f845dff.exe
"C:\Users\Admin\AppData\Local\Temp\08270921eea03fff2bfdc3563f845dff.exe"
1⤵
PID:1168

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1168-0-0x0000000000400000-0x0000000000474754-memory.dmp

Filesize
465KB

Download
memory/1168-1-0x0000000000400000-0x0000000000474754-memory.dmp

Filesize
465KB

Download