4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105

General

Target

4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe
Size

1.3MB
MD5

6c34e066d7d4641690a4ee919ee30036
SHA1

07bfb47a9c3adb044c3bdbb22e4413a4a2c68710
SHA256

4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105
SHA512

601298d91fd4429622a9f799a801d24961b4be8d4c1ac61a6c44bf7dcb2d76cffb0981c9bec5627792d351ebfa73ba89ebc1ea12c4a47be35fc36a2285dd2b62
SSDEEP

24576:PQ9u98/1Xx+nuiSgGKTPFU21HYYajOaIvuonXW:+ITRdfeO97G

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1408 cmd.exe
Drops file in Windows directory 1 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1080 timeout.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1256 taskkill.exe

pid	process
1408	cmd.exe

description	ioc	process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico	explorer.exe

pid	process
1080	timeout.exe

pid	process
1256	taskkill.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe

pid	process
1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe
1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe
1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe
1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exeexplorer.exeAUDIODG.EXEtaskkill.exe

description	pid	process
Token: 33	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe
Token: SeIncBasePriorityPrivilege	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe
Token: SeDebugPrivilege	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: 33	560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	560	AUDIODG.EXE
Token: 33	560	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	560	AUDIODG.EXE
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeShutdownPrivilege	1644	explorer.exe
Token: SeDebugPrivilege	1256	taskkill.exe
Token: SeShutdownPrivilege	1644	explorer.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

explorer.exe

pid	process
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe

Suspicious use of SendNotifyMessage 21 IoCs

Processes:

explorer.exe

pid	process
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe
1644	explorer.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.execmd.exe

description	pid	process	target process
PID 1460 wrote to memory of 1876	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe	cmd.exe
PID 1460 wrote to memory of 1876	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe	cmd.exe
PID 1460 wrote to memory of 1876	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe	cmd.exe
PID 1460 wrote to memory of 1876	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe	cmd.exe
PID 1460 wrote to memory of 1408	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe	cmd.exe
PID 1460 wrote to memory of 1408	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe	cmd.exe
PID 1460 wrote to memory of 1408	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe	cmd.exe
PID 1460 wrote to memory of 1408	1460	4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe	cmd.exe
PID 1408 wrote to memory of 1080	1408	cmd.exe	timeout.exe
PID 1408 wrote to memory of 1080	1408	cmd.exe	timeout.exe
PID 1408 wrote to memory of 1080	1408	cmd.exe	timeout.exe
PID 1408 wrote to memory of 1080	1408	cmd.exe	timeout.exe
PID 1408 wrote to memory of 1256	1408	cmd.exe	taskkill.exe
PID 1408 wrote to memory of 1256	1408	cmd.exe	taskkill.exe
PID 1408 wrote to memory of 1256	1408	cmd.exe	taskkill.exe
PID 1408 wrote to memory of 1256	1408	cmd.exe	taskkill.exe
PID 1408 wrote to memory of 2032	1408	cmd.exe	attrib.exe
PID 1408 wrote to memory of 2032	1408	cmd.exe	attrib.exe
PID 1408 wrote to memory of 2032	1408	cmd.exe	attrib.exe
PID 1408 wrote to memory of 2032	1408	cmd.exe	attrib.exe
PID 1408 wrote to memory of 1260	1408	cmd.exe	attrib.exe
PID 1408 wrote to memory of 1260	1408	cmd.exe	attrib.exe
PID 1408 wrote to memory of 1260	1408	cmd.exe	attrib.exe
PID 1408 wrote to memory of 1260	1408	cmd.exe	attrib.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exe

pid process

2032 attrib.exe
1260 attrib.exe

pid	process
2032	attrib.exe
1260	attrib.exe

C:\Users\Admin\AppData\Local\Temp\4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe
"C:\Users\Admin\AppData\Local\Temp\4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C "ECHO ! ERROR ! & echo.1 & echo. & echo.https://infinitycheats.me/download & echo. && PAUSE"
2⤵
PID:1876

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\b482a262-96eb-4dfc-b553-b1cad325cc01.bat" "
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\SysWOW64\timeout.exe
timeout /T 1
3⤵
- Delays execution with timeout.exe
PID:1080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im "4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Windows\SysWOW64\attrib.exe
attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\4eaac160bc7cacd6ba737410db279c87531532db8b084d66ad8244fc8dc85105.exe"
3⤵
- Views/modifies file attributes
PID:2032

C:\Windows\SysWOW64\attrib.exe
attrib -r -s -h "C:\Users\Admin\AppData\Local\Temp\b482a262-96eb-4dfc-b553-b1cad325cc01.bat"
3⤵
- Views/modifies file attributes
PID:1260

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x580
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:560

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\b482a262-96eb-4dfc-b553-b1cad325cc01.bat
Filesize
380B

MD5
fb544bb9852659214c2cfe4dccb519c0

SHA1
7ccf995756ffb997dbcb9e1ced9207be43a9cb8b

SHA256
30b272fc0e5036310ae1296f8aa06a09d849702bf07ac23ea8f8825c584b73b4

SHA512
fb149cf9806cfd02ca3ae261cfab36c3e774f766542f4141a015d268b581f0d9c48a06042faca5fdd36419c0334d454a2a005712fe2e20b76449d2f1cf6a90f3

Download Submit
memory/1080-63-0x0000000000000000-mapping.dmp

Download
memory/1256-64-0x0000000000000000-mapping.dmp

Download
memory/1260-66-0x0000000000000000-mapping.dmp

Download
memory/1408-61-0x0000000000000000-mapping.dmp

Download
memory/1460-54-0x0000000004AD0000-0x0000000004B56000-memory.dmp

Filesize
536KB

Download
memory/1460-58-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1644-59-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download
memory/1876-60-0x0000000000000000-mapping.dmp

Download
memory/2032-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads