250840c4483d1bef224e7be57d79e91c6d25c4e92839c54df2df472b4735cdb4

Analysis

max time kernel
130s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 15:11

Target

BLUE_REFLECTION.exe
Size

26.2MB
MD5

82f56df0f64cbc495bd86ad1216b6af6
SHA1

d8ff9930b5fd8623328fa54d681868a0cf013fdb
SHA256

250840c4483d1bef224e7be57d79e91c6d25c4e92839c54df2df472b4735cdb4
SHA512

df14bf24a181ab577cd955d883c60b5978d115ff680aea90e0b0e763744e56bc961bc54cf3672138e9daeac73fd404e4ef5638b9afd0a434724c41e590d387ee
SSDEEP

98304:hrOb5W0SLzfORz0QYpOzkY+7sRPyQVaoSe6N11P/Y/H+CEVBbVLlXl80Yg9fOiva:JUCpOzkYDRPykivMJcdPF84dqXs2U2

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	864	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	864	AUDIODG.EXE
Token: 33	864	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	864	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\BLUE_REFLECTION.exe
"C:\Users\Admin\AppData\Local\Temp\BLUE_REFLECTION.exe"
1⤵
PID:2696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:864