Analysis

  • max time kernel
    141s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 14:40

General

  • Target

    Adobe.Photoshop.CS5.Extended.v12.0.ONLY.Keymaker-EMBRACE/keygen.exe

  • Size

    61KB

  • MD5

    b6ac9256dc2c68751facf49b48ffe16e

  • SHA1

    99137f9c21403db6a0c4db70f9c4adca28f46447

  • SHA256

    e11434558518a2b9a43ce0857e1149c927916c208931f6c3a03a921a307ad628

  • SHA512

    69e5eae1595f07c1015760c14e36e47f66030e0a584668579cdbc364033070339bbc1fae3714730fc5ce671d40180dad9a83b984257a9d5390ff70698f7295b6

  • SSDEEP

    1536:CPKC2Ewefe8h5sbFO2EcNmq93j+c5NTS4uvNNKPDd:CCCDzsuoi1RNcPR

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Adobe.Photoshop.CS5.Extended.v12.0.ONLY.Keymaker-EMBRACE\keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\Adobe.Photoshop.CS5.Extended.v12.0.ONLY.Keymaker-EMBRACE\keygen.exe"
    1⤵
      PID:4304
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x50c 0x4c8
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3224

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4304-0-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-1-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-2-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-3-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-4-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-5-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-6-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-7-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-8-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-9-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-10-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-11-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-12-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-13-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-14-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB

    • memory/4304-15-0x0000000000400000-0x0000000000453000-memory.dmp

      Filesize

      332KB