b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381

Analysis

max time kernel
151s
max time network
188s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
Size

1.4MB
MD5

1f037b698f3134e1105b9f298c6e8639
SHA1

62aed76a087a14f52400e4a2c51001dfbfd11e7b
SHA256

b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381
SHA512

6f9ddb93e90be1dfdc822b78d36a08d30a0aa2ed2fe619786b1f1739b8730f8e2aadc2661feaad21367fb97e57044932cd6bfa6bb925ff3bf6ed52b5abe85ac1
SSDEEP

24576:RgJzgFqQHaZlTWkb1cbZBKls/UYG4IhNzDnmNUMuyJDe0Hnf:CWmTPb1c9BWs/UjNhBj6zdaof

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\TesSafe.dll	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
File created	C:\Windows\SysWOW64\ceAte×¢Èë1.ime	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
File created	C:\Windows\SysWOW64\ÄÚ´æ´úÂë.txt	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
File opened for modification	C:\Windows\SysWOW64\TesSafe.dll	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
File created	C:\Windows\SysWOW64\ceAte×¢Èë.ime	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	296	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	296	AUDIODG.EXE
Token: 33	296	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	296	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
2020	b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe

C:\Users\Admin\AppData\Local\Temp\b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe
"C:\Users\Admin\AppData\Local\Temp\b8636c9cad5e022f0efe6dceef4c8b7ca0d14e2d6770c09dfcf987b1d5a7f381.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:2020

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x140
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\ceAte×¢Èë.ime

Filesize
52KB

MD5
32f9c9cebc6b1833788410cbce102ea3

SHA1
d13dfd2789359cad51fdccf8a1f8671de57f9171

SHA256
667d14cf007fd41e0940d0c6ef10b3e8419f8b1200f24ef9197c2590615418e2

SHA512
0e491f95d5856aebdb2c0b7374b908f44653ce989a29742fc6e3466a81bcc4af2db02d2298e9f22a52884d7db82bc3def06292a85c22d5a261812984090b1d0e

Download Submit
\Windows\SysWOW64\ceAte×¢Èë.ime

Filesize
52KB

MD5
32f9c9cebc6b1833788410cbce102ea3

SHA1
d13dfd2789359cad51fdccf8a1f8671de57f9171

SHA256
667d14cf007fd41e0940d0c6ef10b3e8419f8b1200f24ef9197c2590615418e2

SHA512
0e491f95d5856aebdb2c0b7374b908f44653ce989a29742fc6e3466a81bcc4af2db02d2298e9f22a52884d7db82bc3def06292a85c22d5a261812984090b1d0e

Download Submit
\Windows\SysWOW64\ceAte×¢Èë.ime

Filesize
52KB

MD5
32f9c9cebc6b1833788410cbce102ea3

SHA1
d13dfd2789359cad51fdccf8a1f8671de57f9171

SHA256
667d14cf007fd41e0940d0c6ef10b3e8419f8b1200f24ef9197c2590615418e2

SHA512
0e491f95d5856aebdb2c0b7374b908f44653ce989a29742fc6e3466a81bcc4af2db02d2298e9f22a52884d7db82bc3def06292a85c22d5a261812984090b1d0e

Download Submit
\Windows\SysWOW64\ceAte×¢Èë.ime

Filesize
52KB

MD5
32f9c9cebc6b1833788410cbce102ea3

SHA1
d13dfd2789359cad51fdccf8a1f8671de57f9171

SHA256
667d14cf007fd41e0940d0c6ef10b3e8419f8b1200f24ef9197c2590615418e2

SHA512
0e491f95d5856aebdb2c0b7374b908f44653ce989a29742fc6e3466a81bcc4af2db02d2298e9f22a52884d7db82bc3def06292a85c22d5a261812984090b1d0e

Download Submit
\Windows\SysWOW64\ceAte×¢Èë.ime

Filesize
52KB

MD5
32f9c9cebc6b1833788410cbce102ea3

SHA1
d13dfd2789359cad51fdccf8a1f8671de57f9171

SHA256
667d14cf007fd41e0940d0c6ef10b3e8419f8b1200f24ef9197c2590615418e2

SHA512
0e491f95d5856aebdb2c0b7374b908f44653ce989a29742fc6e3466a81bcc4af2db02d2298e9f22a52884d7db82bc3def06292a85c22d5a261812984090b1d0e

Download Submit
\Windows\SysWOW64\ceAte×¢Èë.ime

Filesize
52KB

MD5
32f9c9cebc6b1833788410cbce102ea3

SHA1
d13dfd2789359cad51fdccf8a1f8671de57f9171

SHA256
667d14cf007fd41e0940d0c6ef10b3e8419f8b1200f24ef9197c2590615418e2

SHA512
0e491f95d5856aebdb2c0b7374b908f44653ce989a29742fc6e3466a81bcc4af2db02d2298e9f22a52884d7db82bc3def06292a85c22d5a261812984090b1d0e

Download Submit
\Windows\SysWOW64\ceAte×¢Èë.ime

Filesize
52KB

MD5
32f9c9cebc6b1833788410cbce102ea3

SHA1
d13dfd2789359cad51fdccf8a1f8671de57f9171

SHA256
667d14cf007fd41e0940d0c6ef10b3e8419f8b1200f24ef9197c2590615418e2

SHA512
0e491f95d5856aebdb2c0b7374b908f44653ce989a29742fc6e3466a81bcc4af2db02d2298e9f22a52884d7db82bc3def06292a85c22d5a261812984090b1d0e

Download Submit
\Windows\SysWOW64\ceAte×¢Èë.ime

Filesize
52KB

MD5
32f9c9cebc6b1833788410cbce102ea3

SHA1
d13dfd2789359cad51fdccf8a1f8671de57f9171

SHA256
667d14cf007fd41e0940d0c6ef10b3e8419f8b1200f24ef9197c2590615418e2

SHA512
0e491f95d5856aebdb2c0b7374b908f44653ce989a29742fc6e3466a81bcc4af2db02d2298e9f22a52884d7db82bc3def06292a85c22d5a261812984090b1d0e

Download Submit
\Windows\SysWOW64\ceAte×¢Èë.ime

Filesize
52KB

MD5
32f9c9cebc6b1833788410cbce102ea3

SHA1
d13dfd2789359cad51fdccf8a1f8671de57f9171

SHA256
667d14cf007fd41e0940d0c6ef10b3e8419f8b1200f24ef9197c2590615418e2

SHA512
0e491f95d5856aebdb2c0b7374b908f44653ce989a29742fc6e3466a81bcc4af2db02d2298e9f22a52884d7db82bc3def06292a85c22d5a261812984090b1d0e

Download Submit
memory/2020-56-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/2020-55-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download
memory/2020-54-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/2020-67-0x0000000000400000-0x000000000073B000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads