56f4cb592f497bf2e259e31eba53719910bea7f34e49df9939a4ab474fd0d2e9

Resubmissions

17/08/2024, 20:57

max time kernel
15s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 20:57

Target

vax/scammer.exe
Size

11.0MB
MD5

d395aef1389ea5a0b621a159803b43a7
SHA1

8564f7619a2101949aad90f368df2f0ef14c16e2
SHA256

2546d9f28d9c1d28056dd8f99a953e7e6e2aa016007d00dc59c3d3f9f31ca695
SHA512

effa11e8cf10379c24295f0fd38486851f7e3cf5dc3b9b357c0811abf3259e0c968351a3270ae1df5562d8a73c1cddd6f61f4c9e7aa90bbe7fad7f2164136208
SSDEEP

196608:2vdhw2Q3zNTjVD7b4TyVTjQve/Q2AivMqne2COhve3R2NMDaugcmsFHSQ5d:2yzNTV7bpTjQvWQ2AivMqe2COg2ODsNi

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2788	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2788	AUDIODG.EXE
Token: 33	2788	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2788	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\vax\scammer.exe
"C:\Users\Admin\AppData\Local\Temp\vax\scammer.exe"
1⤵
PID:1740

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788