b334b18b6a86f70403a7982eb2a75ddddaea1411cb2fa1912ed0072e296d881e | Triage

Analysis

max time kernel
10s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:01

Sharing

Report Analysis Logs

General

Target

brewers.exe
Size

64KB
MD5

fe9b0bfc41efe7f3cd90a4acf47f11f4
SHA1

814209ef1f935d08385190951928b993d16edd6f
SHA256

5f4b7200d8fca35fd287348b8597b95cf4b5e0a7a43353cd82a05b8e27c12bcc
SHA512

dc771c25e20699f71619741be2921cd513517aba12b3906d9c93922bfe211393bae6a83f528acd79fe803528fb4f6163e416799787ef8b10d908746639b43181
SSDEEP

1536:ge6YLPYX8bRMa/ulQfFopDSra7MAueK56emPF+5F4AJN40Pbx:gC9G2CpDSu7MAxO6vYpfV

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\srchasst\srchasm.dll	brewers.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	824	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	824	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\brewers.exe
"C:\Users\Admin\AppData\Local\Temp\brewers.exe"
1⤵
- Drops file in Windows directory
PID:2708

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads