508a2a2f736398e5a07d05dd00bf9bbeb12000d178f7641fb54979195b5c02c6

Analysis

max time kernel
329s
max time network
344s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
07/12/2022, 03:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

508a2a2f736398e5a07d05dd00bf9bbeb12000d178f7641fb54979195b5c02c6.exe
Size

292KB
MD5

727a0cb5cc218e9c327dfa9944d7e0ac
SHA1

4310765b31e23c2b6abf432d081cf4daf9b002a0
SHA256

508a2a2f736398e5a07d05dd00bf9bbeb12000d178f7641fb54979195b5c02c6
SHA512

ee4fbed06f195b2148d05ec0d1a8b2f1472c03e61aaa99621106d8d35316d295a270d31bf03b145e4b3507c05d7ea9f4bb437e2bf92e138d6681b5d878e5fbaf
SSDEEP

6144:Dcfp54QB+L//wYZ1qgQtcaOkqn5svsYs+7d:2Pd+L//wW1qgQtcaOV5WhT7d

Score

6^/10

Malware Config

Signatures

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	508a2a2f736398e5a07d05dd00bf9bbeb12000d178f7641fb54979195b5c02c6.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	508a2a2f736398e5a07d05dd00bf9bbeb12000d178f7641fb54979195b5c02c6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1564	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1564	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2504	508a2a2f736398e5a07d05dd00bf9bbeb12000d178f7641fb54979195b5c02c6.exe

C:\Users\Admin\AppData\Local\Temp\508a2a2f736398e5a07d05dd00bf9bbeb12000d178f7641fb54979195b5c02c6.exe
"C:\Users\Admin\AppData\Local\Temp\508a2a2f736398e5a07d05dd00bf9bbeb12000d178f7641fb54979195b5c02c6.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of SetWindowsHookEx
PID:2504

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads