63fdd9dd76d0b29aac222dff48836910ffae3353e681d3297b2bef3a0065338a | Triage

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 07:43

Sharing

Report Analysis Logs

General

Target

pdtrain.exe
Size

56KB
MD5

52327c8e437f90ec874d9acc979f21c1
SHA1

baf0dbdc4e7066e2d533d3930a1ee9f55d965347
SHA256

2883eb70f9f43dcff2ae0094288114028eb79f5adeb368cde64223605fa58a63
SHA512

27cf5a68f72ca300a286931a09ede2bdb4e1b3fe47e844856a51997ea69180cb49bd48912d3be8169b6d9b7a7a3307b166b18be1f1acf138bc68e4ccd476401c
SSDEEP

1536:TXKA3DrOF5hKQ7EK/A7/RwiBOz6MJMNcEXhpG:T6A3fOF/Tu7pwdzNJSG

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	pdtrain.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3160	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3160	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\pdtrain.exe
"C:\Users\Admin\AppData\Local\Temp\pdtrain.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2104

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f8 0x414
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads