Overview

overview

8

Static

static

Quick Analysis

windows10_x64

8

Analysis

  • max time kernel
    55s
  • max time network
    15s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    07-05-2021 15:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    audacity-win-2.4.2.exe

  • Size

    26.8MB

  • MD5

    cad3e11f580c2dc35503e6ee11833c94

  • SHA1

    522ff2efcc2dc89b6de70c6a0cc486e53b4a7afc

  • SHA256

    1f20cd153b2c322bf1ff9941e4e5204098abdc7da37250ce3fb38612b3e927ba

  • SHA512

    ec112cf72f8602b4dd1ae8f2144b96329af423f9011eeb32abece9ce126f065f39201c0d737a155614848ce917ce9a9b5964b0aaa6d53b50ab98731113750df8

Score
8/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\audacity-win-2.4.2.exe
    "C:\Users\Admin\AppData\Local\Temp\audacity-win-2.4.2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Users\Admin\AppData\Local\Temp\is-MK9FB.tmp\audacity-win-2.4.2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MK9FB.tmp\audacity-win-2.4.2.tmp" /SL5="$5006A,27436400,295936,C:\Users\Admin\AppData\Local\Temp\audacity-win-2.4.2.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:2444

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-MK9FB.tmp\audacity-win-2.4.2.tmp
    MD5

    0d6a4b1517227e494d49fd1f9bc9f8c3

    SHA1

    1581aa63b6abd03400714253ab4713f3d80470f5

    SHA256

    d6108658bd3a728049b01a7d00cc2bb51662ce254f1eb1c0a68330961f17bdc2

    SHA512

    9992fbc5ee0261c483342b748549e3db737974160b68258330a33dd41108c0088e27230c7b08057796a4eb8df008323df9e5e9a45f7fcd6f016b569f5107c403

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-MK9FB.tmp\audacity-win-2.4.2.tmp
    MD5

    0d6a4b1517227e494d49fd1f9bc9f8c3

    SHA1

    1581aa63b6abd03400714253ab4713f3d80470f5

    SHA256

    d6108658bd3a728049b01a7d00cc2bb51662ce254f1eb1c0a68330961f17bdc2

    SHA512

    9992fbc5ee0261c483342b748549e3db737974160b68258330a33dd41108c0088e27230c7b08057796a4eb8df008323df9e5e9a45f7fcd6f016b569f5107c403

    Download Submit

  • memory/2444-116-0x0000000000000000-mapping.dmp

    Download

  • memory/2444-118-0x0000000000640000-0x0000000000641000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3920-114-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

    Download