4f3ea3026e0ab4ec8b47abbfd303c49bd2fee618a096b5ab8cb35e6595cb1e2d

Analysis

max time kernel
145s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 01:39

Target

2024-05-22_464091aefafd8fa567cb7d8e101198c4_ryuk.exe
Size

140KB
MD5

464091aefafd8fa567cb7d8e101198c4
SHA1

2c3d4cea7ae52ac8ca40df3e579d07479ebbef43
SHA256

4f3ea3026e0ab4ec8b47abbfd303c49bd2fee618a096b5ab8cb35e6595cb1e2d
SHA512

2af81731a238c3698078b68d4c49b5bedbd64703a67d4a0952f41389fc13d9cbd4665a540569a7c4d364490ca3553268ded04639efaf91b9e8145c267e8b7ead
SSDEEP

1536:zTai4DwuOPiUxBMDto9ggem5rzgiobAEA7oUEG3sG1XG14Y1qX5sVgYcxsWJvdct:vTggejME2E2sG1XGjC8Nc1FUxW76Mo

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 3740 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 3740 AUDIODG.EXE

description	pid	process
Token: 33	3740	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3740	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2024-05-22_464091aefafd8fa567cb7d8e101198c4_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_464091aefafd8fa567cb7d8e101198c4_ryuk.exe"
1⤵
PID:1504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x468
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3740