a2d60af7bebac9b299db109f8162ed6335fb5dda08f57f00e9dc809d4f138428

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7v20201028
submitted
04-04-2021 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2d60af7bebac9b299db109f8162ed6335fb5dda08f57f00e9dc809d4f138428.bin.sample.exe
Size

30KB
MD5

b36e5c508efea796731d444c189b413c
SHA1

6732af472a3dfd98b73ece76ff00cffdaf2acc1c
SHA256

a2d60af7bebac9b299db109f8162ed6335fb5dda08f57f00e9dc809d4f138428
SHA512

a4ef1386af49c137f704283af67f3a86cdd7b2aeceef00804bdeed9a8074198a284c3091bd00c6e44b33d501aef944e4d7f3e1523018b1e2d07f1ee42ec87909

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

a2d60af7bebac9b299db109f8162ed6335fb5dda08f57f00e9dc809d4f138428.bin.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\CheckServiceD = "C:\\ProgramData\\CheckServiceD.exe"	a2d60af7bebac9b299db109f8162ed6335fb5dda08f57f00e9dc809d4f138428.bin.sample.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	392	AUDIODG.EXE
Token: 33	392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	392	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\a2d60af7bebac9b299db109f8162ed6335fb5dda08f57f00e9dc809d4f138428.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\a2d60af7bebac9b299db109f8162ed6335fb5dda08f57f00e9dc809d4f138428.bin.sample.exe"
1⤵
- Adds Run key to start application
PID:1100

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:392

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1604-2-0x000007FEFB991000-0x000007FEFB993000-memory.dmp

Filesize
8KB

Download