870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc

General

Target

870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe
Size

48KB
MD5

fa5119b94e083c98e3628d2587c2c21c
SHA1

4619bc4aa10134a91d5dbd89ff401ea206314b21
SHA256

870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc
SHA512

90da3b78b2d3575419714fdddd54b46a03b2c91f68dbd5445ed6f56e08b7877af423800be4633e15c6c662c4080406f50f48325c0517bbe5da98cb733a68d380
SSDEEP

384:p7B64MfszLi5h3aRy30fCwYlBi2grEpAy6uFIo9FD9SJdacZ6:fKkzLi5JaPNYlKE16LcseK

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1868	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1868	AUDIODG.EXE
Token: 33	1868	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1868	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1672	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe
1672	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe
1672	870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe

C:\Users\Admin\AppData\Local\Temp\870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe
"C:\Users\Admin\AppData\Local\Temp\870e7fdae828524c3bc4b118472b2ae82eb82201ce47cfe3ed5a5aee280c85cc.exe"
1⤵
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:1672

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-56-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1672-57-0x0000000004791000-0x000000000563D000-memory.dmp

Filesize
14.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads