63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d | Triage™

Resubmissions

07/05/2024, 12:06

240507-n9pqxahf6610

07/05/2024, 12:05

240507-n9masafa6v10

07/05/2024, 12:05

240507-n9lz1sfa6t10

07/05/2024, 12:05

240507-n9ewpsfa5v10

07/05/2024, 12:05

240507-n9dnmshf5710

25/04/2024, 13:00

240425-p8x7bsba4710

Analysis

max time kernel
299s
max time network
268s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe
Size 356KB
Sample240507-n9ewpsfa5v
SHA256 63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d
MD5 6ffbff0cb624b4965fbea168ec43aea8
SHA1 5be9a3b2238e13e0fa17ada96e4bb53a5b58fd81
SHA512 edbcb9de0b4ff80da0debb6c0d8be7198efac3ba5534997396f4461a4b43dd897e09f126e68fe928e7c5f48446583c7ebce7757f4dd72f9bdb19a5e7934a04c0
SSDEEP 6144:LXj4tVpmiFWkppKTXD6x/xai9VJrU+aUh5Px9YKRTw6pPZtM/FSpECb:LXj4tyxMuT6jp9Vvh5PPdZM/0GCb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	audiodg.exe

Executes dropped EXE 1 IoCs

pid	Process
2316	audiodg.exe

Windows security modification 2 TTPs 7 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	audiodg.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Audio Device Graph Isolation = "C:\\1879743453807\\audiodg.exe"	63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Audio Device Graph Isolation = "C:\\1879743453807\\audiodg.exe"	63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2316	2932	63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe	93
PID 2932 wrote to memory of 2316	2932	63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe	93
PID 2932 wrote to memory of 2316	2932	63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe	93

C:\Users\Admin\AppData\Local\Temp\63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe
"C:\Users\Admin\AppData\Local\Temp\63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2932
- C:\1879743453807\audiodg.exe
  C:\1879743453807\audiodg.exe
  2⤵
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

audiodg.exe

Path C:\1879743453807\audiodg.exe
Size 356KB
SHA256 63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d
MD5 6ffbff0cb624b4965fbea168ec43aea8
SHA1 5be9a3b2238e13e0fa17ada96e4bb53a5b58fd81
SHA512 edbcb9de0b4ff80da0debb6c0d8be7198efac3ba5534997396f4461a4b43dd897e09f126e68fe928e7c5f48446583c7ebce7757f4dd72f9bdb19a5e7934a04c0
SSDEEP 6144:LXj4tVpmiFWkppKTXD6x/xai9VJrU+aUh5Px9YKRTw6pPZtM/FSpECb:LXj4tyxMuT6jp9Vvh5PPdZM/0GCb
MD5 SHA1 SHA512 SSDEEP

Submit Download