aeaec6ca7cfc629df46779db6f5b92da8a532bd3baf21570ea76e9f9f5becd40 | Triage

Analysis

max time kernel
1640s
max time network
1598s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
20-12-2022 19:34

Sharing

Report Analysis Logs

General

Target

$RTKOW1B.zip
Size

827KB
MD5

bd1619082ee07b21fa40d532ef9cb8e4
SHA1

443713056deb34363bed0e165099412d23d4269d
SHA256

aeaec6ca7cfc629df46779db6f5b92da8a532bd3baf21570ea76e9f9f5becd40
SHA512

a19aa3cc69af6e83722bc79d5baa72336ed1bbb1c8297e2b4b068a95f31e51f1d5dde67e6cceebf0d0b4265866a0bd918db6f0f3b024f07383ac13721a6bd207
SSDEEP

24576:KoqpFTwvyQNR53uFPnTsuLJR6LJsDzpDO4lc0:KppFANnu9QmJR6LYK4lc0

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1400	AUDIODG.EXE
Token: 33	1400	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1400	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\$RTKOW1B.zip
1⤵
PID:656

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:868

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x47c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/868-54-0x000007FEFC131000-0x000007FEFC133000-memory.dmp

Filesize
8KB

Download