054bc2d1b20d3c3d6a579abd3ec64f4af7ab867a2e67cf3b3109b97e283525a5

General

Target

SDFSDF.exe
Size

843KB
MD5

0871dd1f1093919339d3a65c1bde4471
SHA1

f6842e06cc4801dad8db4bf29614b1fdb772cd7b
SHA256

054bc2d1b20d3c3d6a579abd3ec64f4af7ab867a2e67cf3b3109b97e283525a5
SHA512

5ad913164f94333f10df0e49f94ee792092ea8a8bed949722a595090f716e46455a366ec0ff7cfe156c4928d86e5d564293702092c70a1dd17e0218560a2ff66
SSDEEP

24576:1PS04YNEMuExDiU6E5R9s8xY/2l/dTZIbt+rg:1l4auS+UjfU2TTZIbt+r

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	SDFSDF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	AudioDriver.exe

Executes dropped EXE 1 IoCs

pid	Process
1284	AudioDriver.exe

Loads dropped DLL 1 IoCs

pid	Process
1284	AudioDriver.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	SDFSDF.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	SDFSDF.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	SDFSDF.exe
File opened for modification	C:\Windows\assembly	SDFSDF.exe
File created	C:\Windows\assembly\Desktop.ini	SDFSDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3292	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe
1284	AudioDriver.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	AudioDriver.exe
Token: 33	1760	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1760	AUDIODG.EXE
Token: SeManageVolumePrivilege	4708	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1284	AudioDriver.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1284	AudioDriver.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1284	AudioDriver.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1284	4372	SDFSDF.exe	90
PID 4372 wrote to memory of 1284	4372	SDFSDF.exe	90
PID 4372 wrote to memory of 1284	4372	SDFSDF.exe	90
PID 1284 wrote to memory of 2724	1284	AudioDriver.exe	139
PID 1284 wrote to memory of 2724	1284	AudioDriver.exe	139
PID 1284 wrote to memory of 2724	1284	AudioDriver.exe	139
PID 2724 wrote to memory of 3292	2724	cmd.exe	141
PID 2724 wrote to memory of 3292	2724	cmd.exe	141
PID 2724 wrote to memory of 3292	2724	cmd.exe	141
PID 2724 wrote to memory of 3404	2724	cmd.exe	142
PID 2724 wrote to memory of 3404	2724	cmd.exe	142
PID 2724 wrote to memory of 3404	2724	cmd.exe	142
PID 2724 wrote to memory of 3196	2724	cmd.exe	143
PID 2724 wrote to memory of 3196	2724	cmd.exe	143
PID 2724 wrote to memory of 3196	2724	cmd.exe	143
PID 2724 wrote to memory of 1424	2724	cmd.exe	144
PID 2724 wrote to memory of 1424	2724	cmd.exe	144
PID 2724 wrote to memory of 1424	2724	cmd.exe	144
PID 2724 wrote to memory of 4304	2724	cmd.exe	145
PID 2724 wrote to memory of 4304	2724	cmd.exe	145
PID 2724 wrote to memory of 4304	2724	cmd.exe	145

C:\Users\Admin\AppData\Local\Temp\SDFSDF.exe
"C:\Users\Admin\AppData\Local\Temp\SDFSDF.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\{f58b4faf-52e0-4929-b75f-1f5250ad87f8}.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3292
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo j "
      4⤵
      PID:3404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe""
      4⤵
      PID:3196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo j "
      4⤵
      PID:1424
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" del C:\Users\Admin\AppData\Local\Temp\{f58b4faf-52e0-4929-b75f-1f5250ad87f8}.bat"
      4⤵
      PID:4304

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f8 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\opus.dll

Filesize
332KB

MD5
1fc04b8bb4896745163df806695ee193

SHA1
39174ce2fca9a3e86bb7a5686037bc42f2572de1

SHA256
3f2b2fd440fdd84288dadfc63e37a4bc7ea0aae26889ab0d4a5ef6148f44ce14

SHA512
3ff18bdd364f27e54ffbf2d1af53e3500ec57e7e8fa14185f7fb1ef6639d69ac6253543b9e2155ade45ca5bcd567e94334f1ee7ad0a7ff28194168dc49883261

Download Submit
C:\Users\Admin\AppData\Local\Temp\{f58b4faf-52e0-4929-b75f-1f5250ad87f8}.bat

Filesize
202B

MD5
69310bb8bc6eddcdb2803a45cd2298dc

SHA1
7c196248bf7a2074eb4420327a174a062f3457b6

SHA256
4468a07b997157c3e2014e4d2b925446aa16ce49072e4de5279441fa441ad1d2

SHA512
3d13fbdad0b8ac33af8c43cfd5ec7f60bf18a6c5ecd8d3f6851da10fcef762f64bffb8e6f4e1fba08bf76ff6701734e78c6c53b3d53b27aaa3ae124b7bdba7b6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe

Filesize
843KB

MD5
0871dd1f1093919339d3a65c1bde4471

SHA1
f6842e06cc4801dad8db4bf29614b1fdb772cd7b

SHA256
054bc2d1b20d3c3d6a579abd3ec64f4af7ab867a2e67cf3b3109b97e283525a5

SHA512
5ad913164f94333f10df0e49f94ee792092ea8a8bed949722a595090f716e46455a366ec0ff7cfe156c4928d86e5d564293702092c70a1dd17e0218560a2ff66

Download Submit
memory/1284-26-0x0000000001910000-0x0000000001920000-memory.dmp

Filesize
64KB

Download
memory/1284-32-0x0000000001910000-0x0000000001920000-memory.dmp

Filesize
64KB

Download
memory/1284-19-0x0000000074E70000-0x0000000075421000-memory.dmp

Filesize
5.7MB

Download
memory/1284-20-0x0000000074E70000-0x0000000075421000-memory.dmp

Filesize
5.7MB

Download
memory/1284-23-0x0000000001910000-0x0000000001920000-memory.dmp

Filesize
64KB

Download
memory/1284-24-0x0000000074E70000-0x0000000075421000-memory.dmp

Filesize
5.7MB

Download
memory/1284-25-0x0000000001910000-0x0000000001920000-memory.dmp

Filesize
64KB

Download
memory/1284-84-0x0000000074E70000-0x0000000075421000-memory.dmp

Filesize
5.7MB

Download
memory/1284-31-0x0000000001910000-0x0000000001920000-memory.dmp

Filesize
64KB

Download
memory/4372-18-0x0000000074E70000-0x0000000075421000-memory.dmp

Filesize
5.7MB

Download
memory/4372-2-0x0000000000F00000-0x0000000000F10000-memory.dmp

Filesize
64KB

Download
memory/4372-0-0x0000000074E70000-0x0000000075421000-memory.dmp

Filesize
5.7MB

Download
memory/4372-1-0x0000000074E70000-0x0000000075421000-memory.dmp

Filesize
5.7MB

Download
memory/4708-49-0x00000289C7680000-0x00000289C7690000-memory.dmp

Filesize
64KB

Download
memory/4708-67-0x00000289CFA20000-0x00000289CFA21000-memory.dmp

Filesize
4KB

Download
memory/4708-65-0x00000289CF9F0000-0x00000289CF9F1000-memory.dmp

Filesize
4KB

Download
memory/4708-68-0x00000289CFA20000-0x00000289CFA21000-memory.dmp

Filesize
4KB

Download
memory/4708-69-0x00000289CFB30000-0x00000289CFB31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing