9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36

General

Target

9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe
Size

104KB
MD5

cba3b0e6039a4f6de878975a27a6b5b8
SHA1

03db378b2f6556e3bd6658d14215b812c605dfa1
SHA256

9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36
SHA512

d8cd402e1c87199db5641590428532597237f3e4434556946a06afb16e1222cdc62116be8d77830001b7cafd430502b338f72d99d13ca17669658a95bd514f85
SSDEEP

1536:oevhl6GC5V4IVUom/HpR8fA8Ixe2+HLmrUIj:GGC5Vjaom/HpRRtxP+rmrn

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe

description	pid	process	target process
PID 620 set thread context of 1188	620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1584	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1584	AUDIODG.EXE
Token: 33	1584	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1584	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe

pid	process
620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe
1188	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
1188	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
1188	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe

description	pid	process	target process
PID 620 wrote to memory of 1188	620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
PID 620 wrote to memory of 1188	620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
PID 620 wrote to memory of 1188	620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
PID 620 wrote to memory of 1188	620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
PID 620 wrote to memory of 1188	620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
PID 620 wrote to memory of 1188	620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
PID 620 wrote to memory of 1188	620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
PID 620 wrote to memory of 1188	620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
PID 620 wrote to memory of 1188	620	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe	9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe

C:\Users\Admin\AppData\Local\Temp\9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe
"C:\Users\Admin\AppData\Local\Temp\9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620
- C:\Users\Admin\AppData\Local\Temp\9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe
  "C:\Users\Admin\AppData\Local\Temp\9140d596fcd958011d8bdb21cbd5089a2bf2cf038e7675dac07db5397522ed36.eXe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1188

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x540
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1188-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1188-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1188-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1188-62-0x0000000000401358-mapping.dmp

Download
memory/1188-66-0x0000000075711000-0x0000000075713000-memory.dmp

Filesize
8KB

Download
memory/1188-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1188-81-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads