8616764aa95ab0686631678fa9f307506baf857bc55809dd23ef2ce190a3db1e

Analysis

max time kernel
71s
max time network
70s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8616764aa95ab0686631678fa9f307506baf857bc55809dd23ef2ce190a3db1e.exe
Size

27KB
MD5

5852ebc8c838249aebab5a7e0e79ad90
SHA1

a67c55b92cbc3f1c138aaf34cdcc92d8f7847079
SHA256

8616764aa95ab0686631678fa9f307506baf857bc55809dd23ef2ce190a3db1e
SHA512

61d2d0a8ab50f3ae99d4a7b9ef5e749aaeda2aa3824efa8cb9232d81e3d78bcd4059debf05ae54583382c50dab30b0edaac1c73702ce7ad58ba02dca4ead7616
SSDEEP

384:ln8ZVh/3Zd/E3ZE+bAJMLFYs0adVxokr7MDRvQsV/+ne4hcNYapLwq:Z6fn/nzyF0Nl+zcNXkq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	8616764aa95ab0686631678fa9f307506baf857bc55809dd23ef2ce190a3db1e.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	8616764aa95ab0686631678fa9f307506baf857bc55809dd23ef2ce190a3db1e.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	8616764aa95ab0686631678fa9f307506baf857bc55809dd23ef2ce190a3db1e.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1696	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1696	AUDIODG.EXE
Token: 33	1696	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1696	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1008	8616764aa95ab0686631678fa9f307506baf857bc55809dd23ef2ce190a3db1e.exe
1008	8616764aa95ab0686631678fa9f307506baf857bc55809dd23ef2ce190a3db1e.exe

C:\Users\Admin\AppData\Local\Temp\8616764aa95ab0686631678fa9f307506baf857bc55809dd23ef2ce190a3db1e.exe
"C:\Users\Admin\AppData\Local\Temp\8616764aa95ab0686631678fa9f307506baf857bc55809dd23ef2ce190a3db1e.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x43c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1008-55-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download
memory/1008-56-0x00000000003E7000-0x00000000003F8000-memory.dmp

Filesize
68KB

Download
memory/1008-57-0x00000000741F0000-0x000000007479B000-memory.dmp

Filesize
5.7MB

Download