b55c6df0b0541868d71ba62851b5dbdeac7c2d43cdae9d968f4a06e50c5dcc0d

Analysis

max time kernel
29s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17/02/2023, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BeamNG.drive.exe
Size

3.2MB
MD5

894e69a7ebc542878aedcd7ca3cdd7d4
SHA1

c69ae4bd40d5765310989c0bfb78abeb2cb9a918
SHA256

b55c6df0b0541868d71ba62851b5dbdeac7c2d43cdae9d968f4a06e50c5dcc0d
SHA512

beefa7429131eb123c385e2b7b043e97810428ee64213ce4e40ea30d5fe1577ae71bf821e1bbfae40c47af43b3e9de3860de1e17e740fb37674b52797f239caf
SSDEEP

49152:5T7FqeYCjuBRJH7oReJpsyip7pzIadGA8d5wL9EJaK:5TkeYCjo7ocatzIad7iiL9O

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\beamng\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BeamNG.drive.exe,0"	BeamNG.drive.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\beamng\shell\open\command	BeamNG.drive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\beamng\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BeamNG.drive.exe\" -command \"%1\""	BeamNG.drive.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\beamng	BeamNG.drive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\beamng\ = "URL:beamng Protocol"	BeamNG.drive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\beamng\URL Protocol	BeamNG.drive.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\beamng\DefaultIcon	BeamNG.drive.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\beamng\shell	BeamNG.drive.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\beamng\shell\open	BeamNG.drive.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	976	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	976	AUDIODG.EXE
Token: 33	976	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	976	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\BeamNG.drive.exe
"C:\Users\Admin\AppData\Local\Temp\BeamNG.drive.exe"
1⤵
- Modifies registry class
PID:1620

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1552

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1552-55-0x000007FEFB8A1000-0x000007FEFB8A3000-memory.dmp

Filesize
8KB

Download
memory/1620-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download