09c63e689daf55ba101c55b9d7463f2a99484a73d94f5f569337aa1213b98bee

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
25-02-2024 12:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

911111.exe
Size

10.3MB
MD5

3ef7356f7dcf963315ed40addd726d48
SHA1

ca2fe0de4a7f95e5a8f4e78081f0b0973db5002a
SHA256

09c63e689daf55ba101c55b9d7463f2a99484a73d94f5f569337aa1213b98bee
SHA512

f388e6427018ec71d92fce5397c4ae5e19528d1ac420343fcd0664f34e75a3873581af6ae19ae3fea9e250e72b5d1ea26a58d95791fccc2f9001e978247cd765
SSDEEP

196608:ajaRQ10I+obJrHuQaRZeThwJyglZpG9+3dqWnylVGMx:V+10I+JQee2JvbpjnylVx

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	911111.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	911111.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3560	911111.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3448	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3448	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3560	911111.exe

C:\Users\Admin\AppData\Local\Temp\911111.exe
"C:\Users\Admin\AppData\Local\Temp\911111.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:3560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x478 0x498
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx

Filesize
366B

MD5
ccfb19e7be8bef78c5765c97e035969a

SHA1
c977505b2356f1ece425643502401a5af9fa5833

SHA256
46f5ea7f33cff2ba50922af808caa4b02b6b7a27a9fc4af83af549d41371071d

SHA512
55c3ab431f44485c1ab7ccf1387deab96db0968c4173b68aaa4c9341e98b245516a5ac60340f1992c5093ce97ba8bab8dc92d5ab993b602247e07214a754360f

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx

Filesize
343B

MD5
b3a2c15833ed3013c1c8f09a3090613b

SHA1
89ad338ef38db8fceda43ef113abfc7ee3e748c4

SHA256
1e6364e1a33cce9395071c75f7d8df3759dc475baa6f677422f29c9bcf3e6869

SHA512
a14189f7236cda4574771269ab1e9da5c100eb5bc59c3dc77a77b5d85b97755f45bf9e28451183128f22aa01a70d63e2e1a54810b22dd57a5c639c9854de8342

Download Submit
memory/3560-0-0x0000000000510000-0x0000000000E7F000-memory.dmp

Filesize
9.4MB

Download
memory/3560-1-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/3560-18-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-19-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-22-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-25-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-26-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-27-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-29-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-30-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-31-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-38-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-39-0x0000000005F30000-0x0000000006130000-memory.dmp

Filesize
2.0MB

Download
memory/3560-174-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-176-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-177-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-179-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-178-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-180-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-181-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-182-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-183-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-184-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-185-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-188-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-187-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-189-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-190-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-186-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-191-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-192-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-193-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-194-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-195-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-197-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-198-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-199-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-201-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-202-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-204-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-203-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-200-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-196-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-205-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-206-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-207-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-208-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-210-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-209-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-211-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-212-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-213-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-214-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-215-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-216-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-217-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-218-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-219-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-220-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-221-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-222-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-223-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-224-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-226-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-225-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-227-0x0000000006130000-0x0000000006330000-memory.dmp

Filesize
2.0MB

Download
memory/3560-1735-0x0000000000510000-0x0000000000E7F000-memory.dmp

Filesize
9.4MB

Download
memory/3560-1737-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download