7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b

General

Target

7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe
Size

745KB
MD5

1af4078a657a85b18db9061bfab45aa0
SHA1

49cb1f039ecf06fa55d7826b08ec5ff9fa1f2533
SHA256

7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b
SHA512

88e96a6213c8a7a0e0725ac07bc425a09399361dff0bc9d6320f1f7e335577ad7686e34fa17f884dd2e4e4fab52647d991bf5d3c53e6447102b465eaead785a6
SSDEEP

12288:PMY7sxIOe7EGvLhRd8HB2tLv/Q2hi+HCMwaOL8gRh0RYpQnKW21L:PjsxWEGvLvu2lisvch

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\lsass.exe	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe
File created	C:\Windows\SysWOW64\drivers\lsass.exe	lsass.exe

Executes dropped EXE 2 IoCs

pid	Process
588	lsass.exe
2016	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.~tmp

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~.pif	lsass.exe

Loads dropped DLL 4 IoCs

pid	Process
968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe
968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe
968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe
968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	lsass.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1580	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1580	AUDIODG.EXE
Token: 33	1580	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1580	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe
968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe
588	lsass.exe
588	lsass.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 588	968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe	28
PID 968 wrote to memory of 588	968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe	28
PID 968 wrote to memory of 588	968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe	28
PID 968 wrote to memory of 588	968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe	28
PID 968 wrote to memory of 2016	968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe	29
PID 968 wrote to memory of 2016	968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe	29
PID 968 wrote to memory of 2016	968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe	29
PID 968 wrote to memory of 2016	968	7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe	29

C:\Users\Admin\AppData\Local\Temp\7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe
"C:\Users\Admin\AppData\Local\Temp\7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\SysWOW64\drivers\lsass.exe
  "C:\Windows\system32\drivers\lsass.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops startup file
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:588
- C:\Users\Admin\AppData\Local\Temp\7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.~tmp
  "C:\Users\Admin\AppData\Local\Temp\7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.~tmp "
  2⤵
  - Executes dropped EXE
  PID:2016

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.~tmp

Filesize
681KB

MD5
7059b9652fec66ea003a55397c02a445

SHA1
4232fba43aab22d209e5b448cefaed3cd13730b3

SHA256
8bbc2ae3dacf2ebc0482705fedd3ca31f2d32291a8d609727a14cdf4a1fc368d

SHA512
365d4639f83c5484ff94228b2919491d14c78e26363a61c14d35eabe8414eb74d95b6a654e7e0b5c7355acda8e09ddf9b0c1aa2702c185803e97446c3fff1e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.~tmp

Filesize
681KB

MD5
7059b9652fec66ea003a55397c02a445

SHA1
4232fba43aab22d209e5b448cefaed3cd13730b3

SHA256
8bbc2ae3dacf2ebc0482705fedd3ca31f2d32291a8d609727a14cdf4a1fc368d

SHA512
365d4639f83c5484ff94228b2919491d14c78e26363a61c14d35eabe8414eb74d95b6a654e7e0b5c7355acda8e09ddf9b0c1aa2702c185803e97446c3fff1e11

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
669ffd1dd6fb7a0e4ddbc3ad3b76507b

SHA1
372820d6b9350ad629a489d49876d8bd422b8f31

SHA256
7dc487e762e55ffa601480c4bc7948f85fcd4f025665ff599060ec1f81d7e986

SHA512
cd69694ad3316c768dbe0d1514060870568c67a50785b38d402eb16e94740c5ae351eb6d47284630a2505fac50c9777bedef85608571c85385b1b9c1f12d73f5

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
669ffd1dd6fb7a0e4ddbc3ad3b76507b

SHA1
372820d6b9350ad629a489d49876d8bd422b8f31

SHA256
7dc487e762e55ffa601480c4bc7948f85fcd4f025665ff599060ec1f81d7e986

SHA512
cd69694ad3316c768dbe0d1514060870568c67a50785b38d402eb16e94740c5ae351eb6d47284630a2505fac50c9777bedef85608571c85385b1b9c1f12d73f5

Download Submit
\Users\Admin\AppData\Local\Temp\7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.~tmp

Filesize
681KB

MD5
7059b9652fec66ea003a55397c02a445

SHA1
4232fba43aab22d209e5b448cefaed3cd13730b3

SHA256
8bbc2ae3dacf2ebc0482705fedd3ca31f2d32291a8d609727a14cdf4a1fc368d

SHA512
365d4639f83c5484ff94228b2919491d14c78e26363a61c14d35eabe8414eb74d95b6a654e7e0b5c7355acda8e09ddf9b0c1aa2702c185803e97446c3fff1e11

Download Submit
\Users\Admin\AppData\Local\Temp\7fbfabdc722c6f8bcef7e948f435b5d47e54b2f428eae007b4d727bc17959b1b.~tmp

Filesize
681KB

MD5
7059b9652fec66ea003a55397c02a445

SHA1
4232fba43aab22d209e5b448cefaed3cd13730b3

SHA256
8bbc2ae3dacf2ebc0482705fedd3ca31f2d32291a8d609727a14cdf4a1fc368d

SHA512
365d4639f83c5484ff94228b2919491d14c78e26363a61c14d35eabe8414eb74d95b6a654e7e0b5c7355acda8e09ddf9b0c1aa2702c185803e97446c3fff1e11

Download Submit
\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
669ffd1dd6fb7a0e4ddbc3ad3b76507b

SHA1
372820d6b9350ad629a489d49876d8bd422b8f31

SHA256
7dc487e762e55ffa601480c4bc7948f85fcd4f025665ff599060ec1f81d7e986

SHA512
cd69694ad3316c768dbe0d1514060870568c67a50785b38d402eb16e94740c5ae351eb6d47284630a2505fac50c9777bedef85608571c85385b1b9c1f12d73f5

Download Submit
\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
669ffd1dd6fb7a0e4ddbc3ad3b76507b

SHA1
372820d6b9350ad629a489d49876d8bd422b8f31

SHA256
7dc487e762e55ffa601480c4bc7948f85fcd4f025665ff599060ec1f81d7e986

SHA512
cd69694ad3316c768dbe0d1514060870568c67a50785b38d402eb16e94740c5ae351eb6d47284630a2505fac50c9777bedef85608571c85385b1b9c1f12d73f5

Download Submit
memory/968-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing