6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3 | Triage

Resubmissions

07-05-2024 12:30

240507-ppmaqafg4w 10

07-05-2024 12:30

240507-pplzysfg4v 10

07-05-2024 12:30

240507-ppldesad49 10

07-05-2024 12:30

240507-ppkrwsad48 10

07-05-2024 12:30

240507-pphmjaad45 10

25-04-2024 12:58

240425-p7n72aba35 10

Analysis

max time kernel
300s
max time network
202s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
25-04-2024 12:58

Sharing

Report Analysis Logs

General

Target

6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3.exe
Size

96KB
MD5

131962bf60ac02f759cf2f57808eaee9
SHA1

2636de442f3fc52c0a9640875b74ff9d236a359d
SHA256

6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3
SHA512

ee787f0e2ae36c3ed046489be23a0335a325b3a9f38121c6ecd3e1c7d166abbc6779effc13451b01f6838eaa4e299445bc25b1b524110667580bcfbe824a9836
SSDEEP

1536:wB3XC0TP7sRav52HE9jMeR3MnQqrMVMnxb/n6cgNwf5mfF9zz51zpJ7Hx1eqkyF0:wBa01YbOfF9b7R1eqkDF

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

Disable or Modify Tools

Modify Registry

Processes:

audiodg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	audiodg.exe

Executes dropped EXE 1 IoCs

Processes:

audiodg.exe

pid process

3016 audiodg.exe

Windows security modification 2 TTPs 7 IoCs

Disable or Modify Tools

Modify Registry

Processes:

audiodg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	audiodg.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Audio Device Graph Isolation = "C:\\5610211824164\\audiodg.exe"	6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Audio Device Graph Isolation = "C:\\5610211824164\\audiodg.exe"	6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3.exe

description	pid	process	target process
PID 4932 wrote to memory of 3016	4932	6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3.exe	audiodg.exe
PID 4932 wrote to memory of 3016	4932	6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3.exe	audiodg.exe
PID 4932 wrote to memory of 3016	4932	6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3.exe	audiodg.exe

C:\Users\Admin\AppData\Local\Temp\6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3.exe
"C:\Users\Admin\AppData\Local\Temp\6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4932

C:\5610211824164\audiodg.exe
C:\5610211824164\audiodg.exe
2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:3016

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\5610211824164\audiodg.exe
Filesize
96KB

MD5
131962bf60ac02f759cf2f57808eaee9

SHA1
2636de442f3fc52c0a9640875b74ff9d236a359d

SHA256
6dfdfb7f2716f3e3f684e1b8c92431563e3f65d2c64df24d6dda1c8bc6a198a3

SHA512
ee787f0e2ae36c3ed046489be23a0335a325b3a9f38121c6ecd3e1c7d166abbc6779effc13451b01f6838eaa4e299445bc25b1b524110667580bcfbe824a9836

Download Submit