9d2d93f6937b6e133de361ba48b74cc1c785a0fbe3e026ceba3950c286d16de9

Analysis

max time kernel
147s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d2d93f6937b6e133de361ba48b74cc1c785a0fbe3e026ceba3950c286d16de9.exe
Size

2.1MB
MD5

38ba32dd57393a331f0947516e3689e1
SHA1

8df43a773148a32fba022ea0348747dc5363aa04
SHA256

9d2d93f6937b6e133de361ba48b74cc1c785a0fbe3e026ceba3950c286d16de9
SHA512

6e48947fd6eec8ef78500decd139f697f57dcb892802895d4306af5912398873b0dbb991094233065e8769a79091542211e6aaa3a30a84daf9b948a3e1ed3ca4
SSDEEP

24576:+47LOvTL65h4bqlWKccv03Tv27TdZJKTY9C9UzbI4+Ukx5ytkjxGGT3BVqAFyZ9R:+tch4bq4Kc5TqgJbTjxVBVngX

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	9d2d93f6937b6e133de361ba48b74cc1c785a0fbe3e026ceba3950c286d16de9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ClientAutoStart = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MdrAutoStart.exe"	9d2d93f6937b6e133de361ba48b74cc1c785a0fbe3e026ceba3950c286d16de9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1324	9d2d93f6937b6e133de361ba48b74cc1c785a0fbe3e026ceba3950c286d16de9.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	480	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	480	AUDIODG.EXE
Token: 33	480	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	480	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\9d2d93f6937b6e133de361ba48b74cc1c785a0fbe3e026ceba3950c286d16de9.exe
"C:\Users\Admin\AppData\Local\Temp\9d2d93f6937b6e133de361ba48b74cc1c785a0fbe3e026ceba3950c286d16de9.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:1324

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x140
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1324-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download