e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116

General

Target

e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
Size

276KB
MD5

f30c40c591d12bffe234ff8fb61ac691
SHA1

aa58eb21562b3b22daa5aaaa6f98a238c3d2692b
SHA256

e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116
SHA512

1b252b968107740e4fe4ef4ab01f339890a327fb5dd7d88b2e063ff50c6a6afa193e8076c34a1d5a0909a9a4b57794313a3c6657e48324ffa39c1829c6563edb
SSDEEP

3072:thTPbp4T7ReBXMA2cz92GrgMYeHxutbRzKe8SAJn0m:tcSLtFYeF0

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\B:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\F:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\J:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\M:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\T:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\V:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\X:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\L:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\Y:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\A:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\I:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\K:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\N:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\R:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\U:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\E:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\G:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\H:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\O:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\P:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\Q:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\S:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
File opened (read-only)	\??\W:	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1980	AUDIODG.EXE
Token: 33	1980	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1980	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1672	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
1672	e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe

C:\Users\Admin\AppData\Local\Temp\e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe
"C:\Users\Admin\AppData\Local\Temp\e311691dc1e3fc72948dbfc1834476e5ec2d54ed089f09963b649ea2bc277116.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:1672

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x568
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1672-57-0x0000000004A70000-0x0000000004AC9000-memory.dmp

Filesize
356KB

Download
memory/1672-59-0x0000000004E80000-0x0000000004FF7000-memory.dmp

Filesize
1.5MB

Download
memory/1672-60-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/1672-61-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download
memory/1672-62-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download
memory/1672-63-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download
memory/1672-64-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download
memory/1672-65-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download
memory/1672-70-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download
memory/1672-69-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download
memory/1672-68-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download
memory/1672-67-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download
memory/1672-66-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download
memory/1672-71-0x00000000048F0000-0x00000000048FA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing