Overview

overview

7

Static

static

Ableton Li...o].exe

windows7-x64

7

Ableton Li...o].exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220812-es
  • resource tags

    arch:x64arch:x86image:win7-20220812-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    03/01/2023, 02:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ableton LivePatch [io].exe

  • Size

    565KB

  • MD5

    e2f36b23167882c584d1ef1642fc2b01

  • SHA1

    41ad4b4f935c54b284f8b993efa9f5e81a887006

  • SHA256

    a417e8c0a5e9f8a93743e4c8972cfc4f912ec0f9000f706df4836037dca38d53

  • SHA512

    c42bd7158d64e73d6ffb1097d062fd30a646b445d05e722f28403d13a1c721c8bfc81b3f06701d5b373f74ec666c169cd6dec67e83bb22b9e0887194b1c1abc1

  • SSDEEP

    12288:u1y/NW3cE/07TmYuVR7YQU3lbggexIZtTV2sjFvcdC2QL13oSqu:u1y1W3B03mYucQU3lbggpJ2sNEC2QL1s

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ableton LivePatch [io].exe
    "C:\Users\Admin\AppData\Local\Temp\Ableton LivePatch [io].exe"
    1⤵
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1100
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x2e4
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:368
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
      PID:1840

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\bassmod.dll
      Filesize

      9KB

      MD5

      780d14604d49e3c634200c523def8351

      SHA1

      e208ef6f421d2260070a9222f1f918f1de0a8eeb

      SHA256

      844eb66a10b848d3a71a8c63c35f0a01550a46d2ff8503e2ca8947978b03b4d2

      SHA512

      a49c030f11da8f0cdc4205c86bec00653ec2f8899983cad9d7195fd23255439291aaec5a7e128e1a103efd93b8566e86f15af89eba4efebf9debce14a7a5564b

      Download Submit

    • \Users\Admin\AppData\Local\Temp\dup2patcher.dll
      Filesize

      547KB

      MD5

      7b677aa98986a1145c31bc858fc45244

      SHA1

      8cc61dbeca97c9e00bd2c919a99e9757d882381e

      SHA256

      7fc4cef987d57a407101ffec1aeb75233c758449597665b1635cdbf4aa7bd8fa

      SHA512

      c7a43d810adf73cd042f456fe8f64a4bff5edd73d37a6b9bb6c8d4bfbb3e422a95a0bc7a9de9b84b5e587fd543a75b60df78d7819c26e0eb681290d8bee1b63b

      Download Submit

    • memory/1100-55-0x0000000076201000-0x0000000076203000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1100-57-0x0000000000280000-0x000000000033B000-memory.dmp

      Filesize

      748KB

      Download

    • memory/1100-58-0x0000000075000000-0x00000000750A1000-memory.dmp

      Filesize

      644KB

      Download

    • memory/1100-59-0x00000000748B1000-0x00000000748B3000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1100-61-0x0000000075000000-0x00000000750A1000-memory.dmp

      Filesize

      644KB

      Download