8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676

Analysis

max time kernel
86s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-10-2022 07:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe
Size

4.2MB
MD5

c036f436a68cb10af14f4f5d7dee1495
SHA1

92a1ee36259beca3fa49977cab11303e70ebf7c4
SHA256

8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676
SHA512

845483c2ef356243b4a400b7623f082c540d70a9964517edd65ad282eefb7ab7b10b3bb51a91fa764298edd182a15515b956531c3fa2c1f86de3a900f2a8887d
SSDEEP

98304:9f7wCQInrje/CAVMJhkmkUZAOjynfcb/N:9fn6/VS9PZ/yfU

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp

Loads dropped DLL 10 IoCs

pid	Process
1968	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1436	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1436	AUDIODG.EXE
Token: 33	1436	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1436	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 1972	1968	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe	26
PID 1968 wrote to memory of 1972	1968	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe	26
PID 1968 wrote to memory of 1972	1968	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe	26
PID 1968 wrote to memory of 1972	1968	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe	26
PID 1968 wrote to memory of 1972	1968	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe	26
PID 1968 wrote to memory of 1972	1968	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe	26
PID 1968 wrote to memory of 1972	1968	8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe	26

C:\Users\Admin\AppData\Local\Temp\8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe
"C:\Users\Admin\AppData\Local\Temp\8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Users\Admin\AppData\Local\Temp\is-1FS3D.tmp\8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1FS3D.tmp\8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp" /SL5="$9012A,3800570,140800,C:\Users\Admin\AppData\Local\Temp\8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:1972

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1ac
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-1FS3D.tmp\8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp

Filesize
1.4MB

MD5
ae9890548f2fcab56a4e9ae446f55b3f

SHA1
e17c970eebbe6d7d693c8ac5a7733218800a5a96

SHA256
09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449

SHA512
154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1FS3D.tmp\8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp

Filesize
1.4MB

MD5
ae9890548f2fcab56a4e9ae446f55b3f

SHA1
e17c970eebbe6d7d693c8ac5a7733218800a5a96

SHA256
09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449

SHA512
154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb

Download Submit
\Users\Admin\AppData\Local\Temp\is-1FS3D.tmp\8ff6d017a12e79f06da61c2f500c15f916c48ee494d5cf5429dd0e47eff46676.tmp

Filesize
1.4MB

MD5
ae9890548f2fcab56a4e9ae446f55b3f

SHA1
e17c970eebbe6d7d693c8ac5a7733218800a5a96

SHA256
09af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449

SHA512
154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb

Download Submit
\Users\Admin\AppData\Local\Temp\is-NRGJD.tmp\BASS.dll

Filesize
103KB

MD5
8005750ec63eb5292884ad6183ae2e77

SHA1
c83e31655e271cd9ef5bff62b10f8d51eb3ebf29

SHA256
df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15

SHA512
febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206

Download Submit
\Users\Admin\AppData\Local\Temp\is-NRGJD.tmp\CallbackCtrl.dll

Filesize
4KB

MD5
f07e819ba2e46a897cfabf816d7557b2

SHA1
8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

SHA256
68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

SHA512
7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

Download Submit
\Users\Admin\AppData\Local\Temp\is-NRGJD.tmp\ISDone.dll

Filesize
452KB

MD5
4feafa8b5e8cdb349125c8af0ac43974

SHA1
7f17e5e1b088fc73690888b215962fbcd395c9bd

SHA256
bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71

SHA512
d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc

Download Submit
\Users\Admin\AppData\Local\Temp\is-NRGJD.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-NRGJD.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-NRGJD.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
\Users\Admin\AppData\Local\Temp\is-NRGJD.tmp\idp.dll

Filesize
220KB

MD5
af555ac9c073f88fe5bf0d677f085025

SHA1
5fff803cf273057c889538886f6992ea05dd146e

SHA256
f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb

SHA512
c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5

Download Submit
\Users\Admin\AppData\Local\Temp\is-NRGJD.tmp\innocallback.dll

Filesize
63KB

MD5
1c55ae5ef9980e3b1028447da6105c75

SHA1
f85218e10e6aa23b2f5a3ed512895b437e41b45c

SHA256
6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

SHA512
1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

Download Submit
\Users\Admin\AppData\Local\Temp\is-NRGJD.tmp\wintb.dll

Filesize
16KB

MD5
9436df49e08c83bad8ddc906478c2041

SHA1
a4fa6bdd2fe146fda2e78fdbab355797f53b7dce

SHA256
1910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435

SHA512
f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf

Download Submit
memory/1968-61-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1968-54-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1968-74-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1968-55-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1972-68-0x0000000007220000-0x0000000007297000-memory.dmp

Filesize
476KB

Download
memory/1972-70-0x00000000749C1000-0x00000000749C3000-memory.dmp

Filesize
8KB

Download
memory/1972-66-0x0000000007100000-0x0000000007115000-memory.dmp

Filesize
84KB

Download
memory/1972-72-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download
memory/1972-58-0x0000000000000000-mapping.dmp

Download
memory/1972-77-0x0000000008930000-0x000000000893F000-memory.dmp

Filesize
60KB

Download
memory/1972-78-0x0000000011000000-0x000000001104C000-memory.dmp

Filesize
304KB

Download