Analysis
-
max time kernel
81s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:47
Static task
static1
Behavioral task
behavioral1
Sample
ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe
Resource
win10v2004-20221111-en
General
-
Target
ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe
-
Size
233KB
-
MD5
ce0ee26bfbc866584bbfe029ba013722
-
SHA1
cc0ec1de94f502b2f5ed694cbbed2bc0045b2572
-
SHA256
ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651
-
SHA512
043726af137aec6e8c6e411e842af3fd7113ae60b6d894705b4a1c38149a46d60ed04e418d2b6c2e9bfa7229208e0c7219ed5fe83a23ebc722050be17524dc64
-
SSDEEP
6144:JZEjiPnqZIxIfY90m6nYw9j+x5cD67rput4fO6tS5M:JMiPRUY90mQYek4+26tS5M
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
iio.exepid process 1272 iio.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Processes:
resource yara_rule behavioral1/memory/784-67-0x0000000000400000-0x00000000004F1000-memory.dmp upx behavioral1/memory/784-72-0x0000000000400000-0x00000000004F1000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exepid process 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe -
Drops file in Windows directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exepid process 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1532 explorer.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
explorer.exeAUDIODG.EXEdescription pid process Token: SeShutdownPrivilege 1532 explorer.exe Token: SeShutdownPrivilege 1532 explorer.exe Token: SeShutdownPrivilege 1532 explorer.exe Token: SeShutdownPrivilege 1532 explorer.exe Token: SeShutdownPrivilege 1532 explorer.exe Token: SeShutdownPrivilege 1532 explorer.exe Token: SeShutdownPrivilege 1532 explorer.exe Token: SeShutdownPrivilege 1532 explorer.exe Token: SeShutdownPrivilege 1532 explorer.exe Token: SeShutdownPrivilege 1532 explorer.exe Token: 33 1292 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1292 AUDIODG.EXE Token: 33 1292 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1292 AUDIODG.EXE Token: SeShutdownPrivilege 1532 explorer.exe Token: SeShutdownPrivilege 1532 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
explorer.exepid process 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
explorer.exepid process 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe 1532 explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exedescription pid process target process PID 784 wrote to memory of 1272 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe iio.exe PID 784 wrote to memory of 1272 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe iio.exe PID 784 wrote to memory of 1272 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe iio.exe PID 784 wrote to memory of 1272 784 ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe iio.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe"C:\Users\Admin\AppData\Local\Temp\ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\iio.exe"C:\Users\Admin\AppData\Local\iio.exe" -gav C:\Users\Admin\AppData\Local\Temp\ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651.exe2⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x58c1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\iio.exeFilesize
233KB
MD5ce0ee26bfbc866584bbfe029ba013722
SHA1cc0ec1de94f502b2f5ed694cbbed2bc0045b2572
SHA256ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651
SHA512043726af137aec6e8c6e411e842af3fd7113ae60b6d894705b4a1c38149a46d60ed04e418d2b6c2e9bfa7229208e0c7219ed5fe83a23ebc722050be17524dc64
-
C:\Users\Admin\AppData\Local\iio.exeFilesize
233KB
MD5ce0ee26bfbc866584bbfe029ba013722
SHA1cc0ec1de94f502b2f5ed694cbbed2bc0045b2572
SHA256ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651
SHA512043726af137aec6e8c6e411e842af3fd7113ae60b6d894705b4a1c38149a46d60ed04e418d2b6c2e9bfa7229208e0c7219ed5fe83a23ebc722050be17524dc64
-
\Users\Admin\AppData\Local\iio.exeFilesize
233KB
MD5ce0ee26bfbc866584bbfe029ba013722
SHA1cc0ec1de94f502b2f5ed694cbbed2bc0045b2572
SHA256ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651
SHA512043726af137aec6e8c6e411e842af3fd7113ae60b6d894705b4a1c38149a46d60ed04e418d2b6c2e9bfa7229208e0c7219ed5fe83a23ebc722050be17524dc64
-
\Users\Admin\AppData\Local\iio.exeFilesize
233KB
MD5ce0ee26bfbc866584bbfe029ba013722
SHA1cc0ec1de94f502b2f5ed694cbbed2bc0045b2572
SHA256ec6826239d4534f7561b69eb5f1f79e39fd624f75ec4c5484c82428231f48651
SHA512043726af137aec6e8c6e411e842af3fd7113ae60b6d894705b4a1c38149a46d60ed04e418d2b6c2e9bfa7229208e0c7219ed5fe83a23ebc722050be17524dc64
-
memory/784-59-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/784-67-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/784-61-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/784-62-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/784-63-0x0000000000200000-0x0000000000205000-memory.dmpFilesize
20KB
-
memory/784-64-0x0000000001D00000-0x0000000001DE1000-memory.dmpFilesize
900KB
-
memory/784-66-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB
-
memory/784-55-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/784-60-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/784-76-0x0000000001D00000-0x0000000001DE1000-memory.dmpFilesize
900KB
-
memory/784-56-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/784-58-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/784-54-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/784-72-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/1272-70-0x0000000000000000-mapping.dmp
-
memory/1532-78-0x000007FEFB2C1000-0x000007FEFB2C3000-memory.dmpFilesize
8KB