Analysis
-
max time kernel
143s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29/01/2024, 03:30
Behavioral task
behavioral1
Sample
7ec585796b714cdc7d1fbf3c436fb9ea.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7ec585796b714cdc7d1fbf3c436fb9ea.exe
Resource
win10v2004-20231222-en
General
-
Target
7ec585796b714cdc7d1fbf3c436fb9ea.exe
-
Size
544KB
-
MD5
7ec585796b714cdc7d1fbf3c436fb9ea
-
SHA1
0d9742e3356f0c2e9ad8c5c6e48530f4d64c1ce0
-
SHA256
74dc9093163ce8daca46f48987fd7f971f1f4f89cc98c98f673293cc71d78b7b
-
SHA512
79253470997b89a44f12047a9e6a580d7c705ebd164b443ebaf68b47f7d8aa32d805f54a5ff26538170c882cd852b7d209b3cb83a467db9399f0a28b1c53d5b4
-
SSDEEP
12288:6GuWm0QRVRdgFkEXIc0pg3xTX2ep3vWQrWKr:Xc7dgadoTXFdeaWe
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3460-0-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-10-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-22-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-23-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-24-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-25-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-26-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-27-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-28-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-29-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-30-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-31-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-32-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-33-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-34-0x0000000000400000-0x0000000000596000-memory.dmp upx behavioral2/memory/3460-35-0x0000000000400000-0x0000000000596000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3460 7ec585796b714cdc7d1fbf3c436fb9ea.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 5064 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5064 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3460 7ec585796b714cdc7d1fbf3c436fb9ea.exe 3460 7ec585796b714cdc7d1fbf3c436fb9ea.exe 3460 7ec585796b714cdc7d1fbf3c436fb9ea.exe 3460 7ec585796b714cdc7d1fbf3c436fb9ea.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ec585796b714cdc7d1fbf3c436fb9ea.exe"C:\Users\Admin\AppData\Local\Temp\7ec585796b714cdc7d1fbf3c436fb9ea.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3460
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4dc 0x5041⤵
- Suspicious use of AdjustPrivilegeToken
PID:5064
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476B
MD5d2183968f9080b37babfeba3ccf10df2
SHA124b9cf589ee6789e567fac3ae5acfc25826d00c6
SHA2564d9b83714539f82372e1e0177924bcb5180b75148e22d6725468fd2fb6f96bcc
SHA5120e16d127a199a4238138eb99a461adf2665cee4f803d63874b4bcef52301d0ecd1d2eb71af3f77187916fe04c5f9b152c51171131c2380f31ca267a0a46d2a42