Analysis
-
max time kernel
840s -
max time network
844s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 02:17
Static task
static1
Behavioral task
behavioral1
Sample
RayzToolz.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
RayzToolz.exe
Resource
win10v2004-20240226-en
General
-
Target
RayzToolz.exe
-
Size
843KB
-
MD5
2cf3ca9a7e5f493696cd6be71fa23ad4
-
SHA1
f29e7a1dac76b03bc72d92a19fb25c4530c757e6
-
SHA256
890583091e8669f5ef1ce09a8e97611ebaf4eb55ce2938e449ca5fbf8e430845
-
SHA512
415749a0a0c2e3b78f5e81766049e90d33385df1edb80e539f367e3752ea412eacb7f8fff0e25aa598b2c04e914154dd1c5ecfa7e1b9bf66afe06b85cb9eeaa7
-
SSDEEP
24576:/PS04YNEMuExDiU6E5R9s8xY/2l/dTDIbt+rV:/l4auS+UjfU2TTDIbt+r
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
AudioDriver.exepid process 2900 AudioDriver.exe -
Loads dropped DLL 1 IoCs
Processes:
RayzToolz.exepid process 2508 RayzToolz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
AudioDriver.exepid process 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AudioDriver.exedescription pid process Token: SeDebugPrivilege 2900 AudioDriver.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
RayzToolz.exedescription pid process target process PID 2508 wrote to memory of 2900 2508 RayzToolz.exe AudioDriver.exe PID 2508 wrote to memory of 2900 2508 RayzToolz.exe AudioDriver.exe PID 2508 wrote to memory of 2900 2508 RayzToolz.exe AudioDriver.exe PID 2508 wrote to memory of 2900 2508 RayzToolz.exe AudioDriver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RayzToolz.exe"C:\Users\Admin\AppData\Local\Temp\RayzToolz.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exeFilesize
843KB
MD52cf3ca9a7e5f493696cd6be71fa23ad4
SHA1f29e7a1dac76b03bc72d92a19fb25c4530c757e6
SHA256890583091e8669f5ef1ce09a8e97611ebaf4eb55ce2938e449ca5fbf8e430845
SHA512415749a0a0c2e3b78f5e81766049e90d33385df1edb80e539f367e3752ea412eacb7f8fff0e25aa598b2c04e914154dd1c5ecfa7e1b9bf66afe06b85cb9eeaa7
-
memory/2508-0-0x0000000074060000-0x000000007460B000-memory.dmpFilesize
5.7MB
-
memory/2508-2-0x0000000002180000-0x00000000021C0000-memory.dmpFilesize
256KB
-
memory/2508-1-0x0000000074060000-0x000000007460B000-memory.dmpFilesize
5.7MB
-
memory/2508-11-0x0000000074060000-0x000000007460B000-memory.dmpFilesize
5.7MB
-
memory/2900-12-0x0000000074060000-0x000000007460B000-memory.dmpFilesize
5.7MB
-
memory/2900-13-0x0000000000C20000-0x0000000000C60000-memory.dmpFilesize
256KB
-
memory/2900-14-0x0000000074060000-0x000000007460B000-memory.dmpFilesize
5.7MB
-
memory/2900-15-0x0000000074060000-0x000000007460B000-memory.dmpFilesize
5.7MB