d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9

General

Target

d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
Size

230KB
MD5

09f6dc93589a81c71625a439206ede00
SHA1

e55f8b5739602c2a31ff825452dbbbf0678e46f6
SHA256

d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9
SHA512

55ee0e9c7ca6a81c4081dc2a7a83855992b361070e6388bf09ee0ded7deba16f9817e34a6534457cc876753d250be51d38f6a54e1aec578f656ad63a527017db
SSDEEP

6144:xgvpgvBO/C/CLOoi8IvUINIFiSkMiEFqWld5V:ogpgCkOoi8uUINFSkMiTWj

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
File created	C:\Windows\System32\drivers\etc\hosts.ics	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
1048	taskkill.exe
1304	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RunDll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RunDll32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	taskkill.exe
Token: SeDebugPrivilege	1304	taskkill.exe
Token: 33	748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	748	AUDIODG.EXE
Token: 33	748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	748	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1356	RunDll32.exe
604	RunDll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1048	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	27
PID 1256 wrote to memory of 1048	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	27
PID 1256 wrote to memory of 1048	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	27
PID 1256 wrote to memory of 1048	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	27
PID 1256 wrote to memory of 604	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	32
PID 1256 wrote to memory of 604	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	32
PID 1256 wrote to memory of 604	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	32
PID 1256 wrote to memory of 604	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	32
PID 1256 wrote to memory of 604	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	32
PID 1256 wrote to memory of 604	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	32
PID 1256 wrote to memory of 604	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	32
PID 1256 wrote to memory of 1356	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	33
PID 1256 wrote to memory of 1356	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	33
PID 1256 wrote to memory of 1356	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	33
PID 1256 wrote to memory of 1356	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	33
PID 1256 wrote to memory of 1356	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	33
PID 1256 wrote to memory of 1356	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	33
PID 1256 wrote to memory of 1356	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	33
PID 1256 wrote to memory of 1304	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	34
PID 1256 wrote to memory of 1304	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	34
PID 1256 wrote to memory of 1304	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	34
PID 1256 wrote to memory of 1304	1256	d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe	34

C:\Users\Admin\AppData\Local\Temp\d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe
"C:\Users\Admin\AppData\Local\Temp\d89840e9ffdf7187337862884ca5467937ef9a9f53299a511e971c8ee90e06f9.exe"
1⤵
- Drops file in Drivers directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im lsas.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1048
- C:\Windows\SysWOW64\RunDll32.exe
  RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:604
- C:\Windows\SysWOW64\RunDll32.exe
  RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  PID:1356
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im lsas.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1b0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-57-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/1256-64-0x0000000003D60000-0x0000000004DC2000-memory.dmp

Filesize
16.4MB

Download
memory/1356-62-0x0000000071B51000-0x0000000071B53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing