e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad

General

Target

e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
Size

303KB
MD5

17d0f3a43ddfbd9972b85fc82afcc7cf
SHA1

959ccb51a5cbb6a1a36b0318ca4358d4b0a6cd1a
SHA256

e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad
SHA512

a0128bc83b90b76ad6b03a18c12bbac98cff4a9b2d83f56b2bcd2d0a75ff01d943afe415b2f579c86030b8b223957ede17f40c72325b70b5b3a8e9ae05797514
SSDEEP

6144:D6I4f+Ub8DwRb18eFesZXXGDW2rNr6iaGE2YpVkF0CAvEO4:+UIb1uFHRdaGE2Y8F0dsO4

Score

8^/10

evasion persistence

Malware Config

Signatures

Disables taskbar notifications via registry modification
evasion

Executes dropped EXE 1 IoCs

pid	Process
660	crh.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Deletes itself 1 IoCs

pid	Process
660	crh.exe

Loads dropped DLL 2 IoCs

pid	Process
1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico	explorer.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1668	explorer.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: SeShutdownPrivilege	1668	explorer.exe
Token: 33	396	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	396	AUDIODG.EXE
Token: 33	396	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	396	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe
1668	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 660	1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe	28
PID 1152 wrote to memory of 660	1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe	28
PID 1152 wrote to memory of 660	1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe	28
PID 1152 wrote to memory of 660	1152	e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe	28

C:\Users\Admin\AppData\Local\Temp\e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
"C:\Users\Admin\AppData\Local\Temp\e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\crh.exe
  "C:\Users\Admin\AppData\Local\crh.exe" -gav C:\Users\Admin\AppData\Local\Temp\e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad.exe
  2⤵
  - Executes dropped EXE
  - Deletes itself
  PID:660

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1668

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\crh.exe

Filesize
303KB

MD5
17d0f3a43ddfbd9972b85fc82afcc7cf

SHA1
959ccb51a5cbb6a1a36b0318ca4358d4b0a6cd1a

SHA256
e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad

SHA512
a0128bc83b90b76ad6b03a18c12bbac98cff4a9b2d83f56b2bcd2d0a75ff01d943afe415b2f579c86030b8b223957ede17f40c72325b70b5b3a8e9ae05797514

Download Submit
\Users\Admin\AppData\Local\crh.exe

Filesize
303KB

MD5
17d0f3a43ddfbd9972b85fc82afcc7cf

SHA1
959ccb51a5cbb6a1a36b0318ca4358d4b0a6cd1a

SHA256
e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad

SHA512
a0128bc83b90b76ad6b03a18c12bbac98cff4a9b2d83f56b2bcd2d0a75ff01d943afe415b2f579c86030b8b223957ede17f40c72325b70b5b3a8e9ae05797514

Download Submit
\Users\Admin\AppData\Local\crh.exe

Filesize
303KB

MD5
17d0f3a43ddfbd9972b85fc82afcc7cf

SHA1
959ccb51a5cbb6a1a36b0318ca4358d4b0a6cd1a

SHA256
e855a72e8e762e0b8f6e2a7baae92c41bb76f2131c53aade8adf64e1ee18a4ad

SHA512
a0128bc83b90b76ad6b03a18c12bbac98cff4a9b2d83f56b2bcd2d0a75ff01d943afe415b2f579c86030b8b223957ede17f40c72325b70b5b3a8e9ae05797514

Download Submit
memory/660-59-0x0000000000000000-mapping.dmp

Download
memory/660-64-0x0000000001070000-0x00000000010CF764-memory.dmp

Filesize
381KB

Download
memory/660-65-0x0000000001070000-0x00000000010CF764-memory.dmp

Filesize
381KB

Download
memory/1152-54-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download
memory/1152-56-0x0000000000A10000-0x0000000000B2D000-memory.dmp

Filesize
1.1MB

Download
memory/1152-55-0x00000000013C0000-0x000000000141F764-memory.dmp

Filesize
381KB

Download
memory/1152-62-0x00000000013C0000-0x000000000141F764-memory.dmp

Filesize
381KB

Download
memory/1668-63-0x000007FEFC531000-0x000007FEFC533000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing