a7e20d60b293273946f1d008f8eeec2ee15c4a57628e86912064bb3084772f20 | Triage

Analysis

max time kernel
14s
max time network
21s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

giada.exe
Size

13.3MB
MD5

55db85f422f14f8f3489dea1c9450f9d
SHA1

163ee5cad74814e4cabea05cd0729abf506ec8f9
SHA256

65742ae612c632f69c29464b95da61775f6d292eb6bef4beb6dbc7197c6d56ce
SHA512

cab98afc2b8f365bb58c78e201f01233cabc9077f1e809d5f1cbee4c44cb3c3cf5b91145801a7de4c88008fb1cf911c56ec79832c6bf0d87ff92a0262a4c9b24
SSDEEP

98304:n9Yrvhe0CsFg0Wn5m1jDwAu9Mt9ecXvn5+0g2HDE3EjErToZk+bc:YvhNFg0WnkvwN9Qxv5+7kuvrThec

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1120	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1120	AUDIODG.EXE
Token: 33	1120	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1120	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\giada.exe
"C:\Users\Admin\AppData\Local\Temp\giada.exe"
1⤵
PID:2712

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x528
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads