8779168270de0ccf60a1ba0e571135d448f435df4ffd2bd47195c531634d1762

Analysis

max time kernel
101s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/07/2024, 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

֮.exe
Size

1.1MB
MD5

331810e9f6de0679e9cd337aa026aab4
SHA1

88cbc6a80afcfdd2d5506d8f73ca889a669c5eed
SHA256

7c06daa6628997c39580b86e9601ee35c7e688efe0079d11517310f6433911cf
SHA512

5c82f7a497519d8a466d898701c210c27908d12ec9ff0dae56e121b574551648fcbb30d2af0c8e2bdb9b3fc1f86801bdea0fe23858b721a61905eeabcb59e55d
SSDEEP

24576:oWTeo4A7fKVV/NeK2TYIT4/oFaASoA6Vfnw:dTeq7SH/yTYIT4QIoA6Vfnw

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	֮.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE\֮.exe = "1"	֮.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS	֮.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	֮.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	֮.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE	֮.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS\֮.exe = "0"	֮.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT	֮.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	֮.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	֮.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_LMZ_SCRIPT\֮.exe = "0"	֮.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	֮.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2940	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2940	AUDIODG.EXE
Token: 33	2940	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2940	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2712	֮.exe
2712	֮.exe

C:\Users\Admin\AppData\Local\Temp\֮.exe
"C:\Users\Admin\AppData\Local\Temp\֮.exe"
1⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2712

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x5c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\twcache.ini

Filesize
134B

MD5
ad554b96d89f47b2cacc8a96694a6335

SHA1
89451393bcb908d8af851f7fbe845a31e3afa0a9

SHA256
494ff9fbb10590cb66a7c24d274ea78a78f8bd62f8e52fdd00f48811cac02407

SHA512
18f14e2dbe0470d01a1bbcb952ee6b52f651f7df32e2a56d3c40acf1f3936418d25116c9d59f669fdbc6904fc227a60d3eb02742164048b8e49944220a99c181

Download Submit
C:\Users\Admin\AppData\Local\Temp\twcache.ini

Filesize
158B

MD5
7f182b48b94463876f70b6b6b5a330b9

SHA1
ede3fe9709ba4005fa442e6a3d6d9dec18643af1

SHA256
3e2626495e6ab04333789fbbabfb56fb7a827667a743b8864e936762fb8baaf7

SHA512
73a9b43844878123e072952b4f163d8bbfba948dddc2a546bbd7365c1d5c954af2df45f75b2a549deb90c3045bedb6676c21f37d3189ebe7c4d1bbaf41001dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\twcache.ini

Filesize
344B

MD5
02480753e5eb893584548b02aa0fd7b4

SHA1
537bcfd5414942beb4b9da549cc25a49853734c6

SHA256
2d22aae8b4d9a2e01939bd33105cdbce6f3eeb73acb1aa593e962d334e8727e8

SHA512
5a2e71fbec37622eeeec2f16e8b6feca48c8d6f4c49c05d6155f56efded3b8ae77a1c1c319f99eeaa4d0563dd94a669b13bcccd13a3d227e5bea592a29c439dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\֮.ini

Filesize
7KB

MD5
a158daf52fb091120dc7b4824a75111a

SHA1
26c9a167ef8ca2169c6c09e674697361f86b83d9

SHA256
bca1de78892c4ecfc9b5bace2798e844b3e19005eae7c69ba6453a09d7788832

SHA512
9e45bbe7a56fa54d5e3c081b2d79a21f3059275d0e81c50c08e8a04de3f52b638063adf22a7a3afb469f94b65bf5312030b04b47d47d2c57ed612bccd4b4106d

Download Submit
memory/2712-0-0x0000000004530000-0x0000000004532000-memory.dmp

Filesize
8KB

Download