Analysis
-
max time kernel
1640s -
max time network
1598s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
20/12/2022, 19:34
Static task
static1
Behavioral task
behavioral1
Sample
$RTKOW1B.zip
Resource
win7-20221111-en
1 signatures
1800 seconds
Behavioral task
behavioral2
Sample
$RTKOW1B.zip
Resource
win10v2004-20221111-en
13 signatures
1800 seconds
General
-
Target
$RTKOW1B.zip
-
Size
827KB
-
MD5
bd1619082ee07b21fa40d532ef9cb8e4
-
SHA1
443713056deb34363bed0e165099412d23d4269d
-
SHA256
aeaec6ca7cfc629df46779db6f5b92da8a532bd3baf21570ea76e9f9f5becd40
-
SHA512
a19aa3cc69af6e83722bc79d5baa72336ed1bbb1c8297e2b4b068a95f31e51f1d5dde67e6cceebf0d0b4265866a0bd918db6f0f3b024f07383ac13721a6bd207
-
SSDEEP
24576:KoqpFTwvyQNR53uFPnTsuLJR6LJsDzpDO4lc0:KppFANnu9QmJR6LYK4lc0
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1400 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1400 AUDIODG.EXE Token: 33 1400 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1400 AUDIODG.EXE
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\$RTKOW1B.zip1⤵PID:656
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:868
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x47c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1400