9d53a72ba74c8f52834f1eb836b48ca9b320d25d1467d3ea97503e08d79a02cf

Analysis

max time kernel
365s
max time network
418s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d53a72ba74c8f52834f1eb836b48ca9b320d25d1467d3ea97503e08d79a02cf.exe
Size 24KB
Sample221206-ktfxaabg65
SHA256 9d53a72ba74c8f52834f1eb836b48ca9b320d25d1467d3ea97503e08d79a02cf
MD5 f91429f2069d5a97e30da1841b33e25e
SHA1 1a9baf0ef91230e007a37d040a4f76cb33372054
SHA512 b0ebc1a7d271d2cf52ace93a17ca5fb56157c0a6fd90587e78f9fe5f87736aca71233c5cd52e673a4dd6283a86be1478477a13ab1c40511fbd5949ee9d6753ba
SSDEEP 192:Bez6o5FPQBRfXz6oVb21zB1qCM6mnLgEv8iv2nLgEv8iniYD:UzXTPOzXV6NB1tMDnUEvNv2nUEvNnim
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	9d53a72ba74c8f52834f1eb836b48ca9b320d25d1467d3ea97503e08d79a02cf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1596	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1596	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4356	9d53a72ba74c8f52834f1eb836b48ca9b320d25d1467d3ea97503e08d79a02cf.exe

C:\Users\Admin\AppData\Local\Temp\9d53a72ba74c8f52834f1eb836b48ca9b320d25d1467d3ea97503e08d79a02cf.exe
"C:\Users\Admin\AppData\Local\Temp\9d53a72ba74c8f52834f1eb836b48ca9b320d25d1467d3ea97503e08d79a02cf.exe"
1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:4356

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x31c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4356-134-0x0000000000400000-0x0000000000409200-memory.dmp

Download

memory/4356-135-0x0000000000400000-0x0000000000409200-memory.dmp