3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
05-06-2023 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe
Size

4.6MB
MD5

c63dd11e0f9a1ae3b5dd7d2b0c3516aa
SHA1

c95075bd92932a71d65cfaafb546c811e910d819
SHA256

3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20
SHA512

6ebd7021689e834774141da72c8958f73357be447207256f51b6309fd7c51dd65401b7af414f810305670b5a73b1d607b13b66504440817d9f5e2b4948d805a3
SSDEEP

98304:15Cg2aaIU6EfD5fWnPzycNkpspmmCW7fd3CYOcOBkChVTSOZHuA:15Ch4TEfD5fezyLpImy7EmOBkChVTSgJ

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Internet Explorer\Main	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1172	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1172	AUDIODG.EXE
Token: 33	1172	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1172	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe

pid	process
316	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe
316	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe
316	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe
316	3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe

C:\Users\Admin\AppData\Local\Temp\3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe
"C:\Users\Admin\AppData\Local\Temp\3b8478262312b8894f89859640b9a1b970cca2220b229ea04898c57ffb3a0e20.exe"
1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:316

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1172

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\QCNSQOTT\guanggao[1].htm
Filesize
1KB

MD5
9247a7ca941e7d4f7db5278cb92db6ae

SHA1
b32c43ade9e78639d4f57ef62e793b1d72eb84f5

SHA256
a96d35e73b9a156ee31db5eae8de2c260860537bedb1e2487aa68360066d3fe5

SHA512
b597f5a1f8cf694f994daac0fe5c95bec16f694d4ca5ad8b0307ea12ec754a477788bcccfc4b9b79992b9d0aaae448a50764380c96e8fadf45b19fd438662404

Download Submit
memory/316-77-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-102-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-74-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-63-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-65-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-68-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-55-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-71-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-57-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-56-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-83-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-80-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-86-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-89-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-92-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-95-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-98-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-99-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download
memory/316-54-0x0000000000400000-0x000000000102D000-memory.dmp

Filesize
12.2MB

Download