40f1740c4f4157a604f35e423358838c26bee15947880cfde0c45ab560f7ad63

General

Target

8445aa54adf4d666e65084909a7b989a190ec6eca2844546c2e99a8cfb832fad.7z
Size

365KB
MD5

9ddb59932e5f96b26fd3c25d75b0b3d3
SHA1

b3124031948c6a9735d6878563be1b4d5a4e2c3d
SHA256

40f1740c4f4157a604f35e423358838c26bee15947880cfde0c45ab560f7ad63
SHA512

9120da3cf455fdd9864e99f5ddb2f0b0e0b714a8e3eedc94b569c6949934e004043b47c7fa0679a2eb964f434eb339ecf604d12aa9beea1734969b0368c87285
SSDEEP

6144:wm5OFzgmsN7PdH9y8pgN9PrwwzHYSMuLt1g3UhYx3bbn4WovlufOlpPpP1afr:wwOFz1sQpDJrMuLfgEhYluOOlpPpP1az

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 35 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\NodeSlot = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8800310000000000d5563251110050524f4752417e310000700008000400efbeee3a851ad55632512a0000003c000000000001000000000000000000460000000000500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = ffffffff	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

576 rundll32.exe

pid	process
576	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	2016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2016	AUDIODG.EXE
Token: 33	2016	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2016	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

rundll32.exe

pid process

576 rundll32.exe

pid	process
576	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 864 wrote to memory of 576	864	cmd.exe	rundll32.exe
PID 864 wrote to memory of 576	864	cmd.exe	rundll32.exe
PID 864 wrote to memory of 576	864	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\8445aa54adf4d666e65084909a7b989a190ec6eca2844546c2e99a8cfb832fad.7z
1⤵
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\8445aa54adf4d666e65084909a7b989a190ec6eca2844546c2e99a8cfb832fad.7z
2⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:576

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1836

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x180
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-78-0x00000000035E0000-0x00000000035F0000-memory.dmp

Filesize
64KB

Download
memory/576-79-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads