d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de

Analysis

max time kernel
123s
max time network
72s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 14:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de.exe
Size

32KB
MD5

8bc3ddecfbba474d97d0dca0a6e0fb1f
SHA1

665f08380d396f98ea50c7508721545583b21ed1
SHA256

d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de
SHA512

ed8d6a5caec134351f67f818a28ee0808f2581ca277a3e200be036b2ef56b4097d646f055459380f0ad39720de765b70cfecd2421a6da0dd5ace9bdb5b94dda0
SSDEEP

384:/TODsvoEjxZGE2qrUc71AUX2yit4+mskXDWSbW:/RvoEjfGE2qj71AUX2bmsCRb

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\deneme.exe	d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de.exe
File opened for modification	C:\Program Files\deneme.exe	d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1152	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1152	AUDIODG.EXE
Token: 33	1152	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1152	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1080	d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de.exe
1080	d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de.exe
1080	d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de.exe

C:\Users\Admin\AppData\Local\Temp\d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de.exe
"C:\Users\Admin\AppData\Local\Temp\d57c9c34b35f988397f70809808efc7d740c3881df9afa19713d605c195372de.exe"
1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1080

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-56-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download