f2f66d038be816b0fdcf0c4dcb3b1ae792f0d7b6fab17d1ac41c32776dff086e

Analysis

max time kernel
1541s
max time network
1592s
platform
windows10-2004_x64
resource
win10v2004-20221111-es
resource tags

arch:x64arch:x86image:win10v2004-20221111-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
15/02/2023, 04:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

autorun.exe
Size

6.5MB
MD5

62559a99dc475e645926fd06da95b08f
SHA1

51a1d4b2583f23933e36ef725ed88f80a6871a1d
SHA256

c56d5820c25dd2acef7e4e2f47ecd44568255fcc5e3d17bc94ba0a5c9897e446
SHA512

a13d9542efebdcb74c60061ae6cfc13b9ac0d6d7ef54ca171f72ec47a3c934e4a53b68868b1bde49d7aa233456766006cb7ea3fb1deb8cdfec1336b60e839bda
SSDEEP

98304:4t+UD05wK3zmGUN6XT+bwxHR1vj0pgFl6ZauVUeYI2iqoj9ghi1RebM390brVb+:7605wKxUN8DhjXd8UexqojD390brVb+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5004	autorun.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2796	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2796	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5004	autorun.exe
5004	autorun.exe

C:\Users\Admin\AppData\Local\Temp\autorun.exe
"C:\Users\Admin\AppData\Local\Temp\autorun.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5004

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x448 0x3dc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...