7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1

General

Target

7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe
Size

1.3MB
MD5

fd5a5a8125a82507ad066a3dc9684f4b
SHA1

fab1b816f4837417f68f6f4c5ae299875378ba9f
SHA256

7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1
SHA512

7720fe811b00c878af61eb42a9ab0ca19c5862b33afa134e3cda5171e6675cbe74bede7b51cec0f32fa7e92800570c538fc3ba980ffb1c871ac3f80bfebeb9da
SSDEEP

24576:j4HXD3/WBfxnUIGSWY/iNfQ27baD+gN9vR30a/0xfUHPL9kAQ:jkXDWBJHpP6Nj6D+o9vR30K+IQ

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

Processes:

cmd.exe

description ioc process

File created C:\Windows\SysWOW64\administratortestpermissions10041 cmd.exe

description	ioc	process
File created	C:\Windows\SysWOW64\administratortestpermissions10041	cmd.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Internet Explorer\Main	7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1656	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1656	AUDIODG.EXE
Token: 33	1656	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1656	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe

pid	process
960	7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe
960	7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe
960	7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe
960	7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe
960	7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe

description	pid	process	target process
PID 960 wrote to memory of 1076	960	7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe	cmd.exe
PID 960 wrote to memory of 1076	960	7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe	cmd.exe
PID 960 wrote to memory of 1076	960	7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe	cmd.exe
PID 960 wrote to memory of 1076	960	7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe
"C:\Users\Admin\AppData\Local\Temp\7d01b035d0ced7dd20354bea8e316109ab52147a716663a5c561d723beacfec1.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:960

C:\Windows\SysWOW64\cmd.exe
cmd /c echo t>C:\Windows\system32\administratortestpermissions10041
2⤵
- Drops file in System32 directory
PID:1076

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\administratortestpermissions10041
Filesize
3B

MD5
5696feb53a6ad364e3da313d7bb865c2

SHA1
43ac804404d56225c9e0e44018b43c0e46b4be53

SHA256
9e8b03ea3b48312f8e3a15bec7aa85c96a362e2776ac6bc3dfd74a40022bcc8a

SHA512
e4771bcec6bb86578ddb042a126683675e3cca83614f22bf44721b7cfddaa067ed162e692650e48a474d50e3de4728a6bfe4083500580998152cd2b4918b8516

Download Submit
memory/960-70-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-81-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-69-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-58-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-59-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-60-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-54-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-65-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-67-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-71-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-56-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-57-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-68-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-72-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-73-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-74-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-75-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-76-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-77-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-78-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-79-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-80-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download
memory/960-55-0x0000000000400000-0x000000000075D000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads