21249bb0ad8b3391ebc28b1817037326c18f5b3d566e8a59de8f0d2d6202a6b7 | Triage

Analysis

max time kernel
70s
max time network
76s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-01-2023 12:36

Sharing

Report Analysis Logs

General

Target

WUC v13.x Patcher v1.2.zip
Size

806KB
MD5

9fedd2943832a9a91d20b2e3c32dbac1
SHA1

ebc0aef7b72813ef648286c471858a4bd1eedd08
SHA256

803b53b72eea6fd63e3ce6e8b607334d75c4fcfed79d4d0c8ab45b76e683c6d3
SHA512

588b6f30539843f0d7d1e8c3173a62bd8e8654191a8317cee2c766e2bc9aab5e7475e4fcd23ea444ba4b2a81b21829fdf4dc76473d7ba727f4e5379a176d773d
SSDEEP

24576:Pr6leZsYpObwyeLXChhWoKOn7TipMe3ifZ4:oeZsYpOboChhWkn7Ti6e04

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1784	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1784	AUDIODG.EXE
Token: 33	1784	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1784	AUDIODG.EXE

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\WUC v13.x Patcher v1.2.zip"
1⤵
PID:1720

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1612

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-54-0x000007FEFB7D1000-0x000007FEFB7D3000-memory.dmp

Filesize
8KB

Download