97843f28da11cef5c4beb66ae8ec12892b35c0810b6f21e7c4f881dc56a3bcef | Triage

Analysis

max time kernel
1444s
max time network
1444s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 14:28

Sharing

Report Analysis Logs

General

Target

devldr.exe
Size

948KB
MD5

1ff725ecca7207bc9ffd9ee8a08d8059
SHA1

905bc74cd5555c76e93e22d196b75290e9ac748f
SHA256

97843f28da11cef5c4beb66ae8ec12892b35c0810b6f21e7c4f881dc56a3bcef
SHA512

4f8e416a4d997e344c69eead936717f27e0123055f2868b4eca4e01c41d2cc747a2143b854a1fa56ee483d10597edc467f770b14f6e6ff116779a56e9dd2ee4e
SSDEEP

24576:CdZjSZHElaTW2tcigdXqSNLtTLQDQYEd2AcsQ:gBHj76E5vQkYns

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2972	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2972	AUDIODG.EXE
Token: 33	2972	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2972	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\devldr.exe
"C:\Users\Admin\AppData\Local\Temp\devldr.exe"
1⤵
PID:964

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:324

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0xc0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads