95e29851fb9d29ee21c48dc87bb669ec06d2a6db60922ec73043b8fd4630d035 | Triage

Analysis

max time kernel
1566s
max time network
1567s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/08/2024, 10:23

Sharing

Report Analysis Logs

General

Target

entropy.exe
Size

14.2MB
MD5

0e40b0eb1e7a6672ca2812ad78ee714b
SHA1

51d13063ac9e6c7225fcbda4f13b68b051ca96e2
SHA256

95e29851fb9d29ee21c48dc87bb669ec06d2a6db60922ec73043b8fd4630d035
SHA512

450dcb23d2fc83ad36fe4bb71d195b964681ff61c737856d2d4f2910c0a356c3f1f70731c86cd0321d02c234b57ebbc6380bb6e50b2bb1f9982d682ad8902c88
SSDEEP

196608:HWJafoL/tUoTX4ZVbh1Yf0k7Ma/rkFlgdTaUrPPbdfw:HWsfm/sbh1lkSFCdTauZo

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2244	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2244	AUDIODG.EXE
Token: 33	2244	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2244	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\entropy.exe
"C:\Users\Admin\AppData\Local\Temp\entropy.exe"
1⤵
PID:2080

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2580

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x544
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads