a67e62b3dbd8df575f6e1eeecf23d2538cf9421bfd7ed1a0fd8c796ef56d525e | Triage

Resubmissions

26/03/2023, 01:14 UTC

230326-blmkesfa22 3

26/03/2023, 00:25 UTC

230326-aq4h3aeg93 1

26/03/2023, 00:22 UTC

230326-anxyhaeg88 1

Analysis

max time kernel
50s
max time network
44s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26/03/2023, 01:14 UTC

Sharing

Report Analysis Logs

General

Target

Ronawind Setup.exe
Size

45.0MB
MD5

57778b29eb1f9cfd7daeb6af58303f09
SHA1

07a669e0c09905bf3061237fb1aaa3c32a59e61e
SHA256

a67e62b3dbd8df575f6e1eeecf23d2538cf9421bfd7ed1a0fd8c796ef56d525e
SHA512

ab97ce18d0379c774b817f2c3186c4581039a3300bac64e8a914fb92f94853dbb2c1e2f4363e5fc26c86661c9955a0e1db5bdc691887fcb743b06c4ad799373a
SSDEEP

786432:fMguj8Q4VfviqFTrYGOIOjKpNPcqmDAHj:fiAQIHikHvOI2Kbw8D

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1372	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1372	AUDIODG.EXE
Token: 33	1372	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1372	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\Ronawind Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Ronawind Setup.exe"
1⤵
PID:2024

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372

C:\Users\Admin\AppData\Local\Temp\Ronawind Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Ronawind Setup.exe"
1⤵
PID:640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads