63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d | Triage

Resubmissions

07-05-2024 12:06

240507-n9pqxahf66 10

07-05-2024 12:05

240507-n9masafa6v 10

07-05-2024 12:05

240507-n9lz1sfa6t 10

07-05-2024 12:05

240507-n9ewpsfa5v 10

07-05-2024 12:05

240507-n9dnmshf57 10

25-04-2024 13:00

240425-p8x7bsba47 10

Analysis

max time kernel
299s
max time network
277s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
07-05-2024 12:05

Sharing

Report Analysis Logs

General

Target

63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe
Size

356KB
MD5

6ffbff0cb624b4965fbea168ec43aea8
SHA1

5be9a3b2238e13e0fa17ada96e4bb53a5b58fd81
SHA256

63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d
SHA512

edbcb9de0b4ff80da0debb6c0d8be7198efac3ba5534997396f4461a4b43dd897e09f126e68fe928e7c5f48446583c7ebce7757f4dd72f9bdb19a5e7934a04c0
SSDEEP

6144:LXj4tVpmiFWkppKTXD6x/xai9VJrU+aUh5Px9YKRTw6pPZtM/FSpECb:LXj4tyxMuT6jp9Vvh5PPdZM/0GCb

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

Disable or Modify Tools

Modify Registry

Processes:

audiodg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	audiodg.exe

Executes dropped EXE 1 IoCs

Processes:

audiodg.exe

pid process

1944 audiodg.exe

Windows security modification 2 TTPs 7 IoCs

Disable or Modify Tools

Modify Registry

Processes:

audiodg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	audiodg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	audiodg.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Audio Device Graph Isolation = "C:\\30834578913195\\audiodg.exe"	63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Audio Device Graph Isolation = "C:\\30834578913195\\audiodg.exe"	63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe

description	pid	process	target process
PID 4992 wrote to memory of 1944	4992	63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe	audiodg.exe
PID 4992 wrote to memory of 1944	4992	63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe	audiodg.exe
PID 4992 wrote to memory of 1944	4992	63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe	audiodg.exe

C:\Users\Admin\AppData\Local\Temp\63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe
"C:\Users\Admin\AppData\Local\Temp\63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4992

C:\30834578913195\audiodg.exe
C:\30834578913195\audiodg.exe
2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:1944

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\30834578913195\audiodg.exe
Filesize
356KB

MD5
6ffbff0cb624b4965fbea168ec43aea8

SHA1
5be9a3b2238e13e0fa17ada96e4bb53a5b58fd81

SHA256
63b087a9fa01c00b9f07712fa4c46e461245d5364606dd9dc10130d93415bd6d

SHA512
edbcb9de0b4ff80da0debb6c0d8be7198efac3ba5534997396f4461a4b43dd897e09f126e68fe928e7c5f48446583c7ebce7757f4dd72f9bdb19a5e7934a04c0

Download Submit