Overview
overview
7Static
static
3music_morp...ld.exe
windows7-x64
7music_morp...ld.exe
windows10-2004-x64
7$PLUGINSDI...lW.dll
windows7-x64
3$PLUGINSDI...lW.dll
windows10-2004-x64
3$PLUGINSDI...-1.exe
windows7-x64
3$PLUGINSDI...-1.exe
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...eg.dll
windows7-x64
3$PLUGINSDI...eg.dll
windows10-2004-x64
3$PLUGINSDI...pp.dll
windows7-x64
3$PLUGINSDI...pp.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ch.exe
windows7-x64
7$PLUGINSDI...ch.exe
windows10-2004-x64
7$PLUGINSDI...86.exe
windows7-x64
7$PLUGINSDI...86.exe
windows10-2004-x64
7AV Easy DJ.exe
windows7-x64
3AV Easy DJ.exe
windows10-2004-x64
3AV Music Morpher.exe
windows7-x64
3AV Music Morpher.exe
windows10-2004-x64
3AVDataPr.dll
windows7-x64
3AVDataPr.dll
windows10-2004-x64
3AVFunnySpaceCtrl.dll
windows7-x64
3AVFunnySpaceCtrl.dll
windows10-2004-x64
3AVOrganizerCtrl.dll
windows7-x64
3AVOrganizerCtrl.dll
windows10-2004-x64
3AVRegLib.dll
windows7-x64
3AVRegLib.dll
windows10-2004-x64
3Analysis
-
max time kernel
95s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
music_morpher_gold.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
music_morpher_gold.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AccessControlW.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControlW.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/DealioToolbar-stub-1.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/DealioToolbar-stub-1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ModuleReg.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/ModuleReg.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/NSISSupp.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/NSISSupp.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Toolbar-SetDefaultSearch.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Toolbar-SetDefaultSearch.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/vcredist_x86.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/vcredist_x86.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
AV Easy DJ.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
AV Easy DJ.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
AV Music Morpher.exe
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
AV Music Morpher.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
AVDataPr.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
AVDataPr.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
AVFunnySpaceCtrl.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
AVFunnySpaceCtrl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
AVOrganizerCtrl.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
AVOrganizerCtrl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
AVRegLib.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
AVRegLib.dll
Resource
win10v2004-20240802-en
General
-
Target
AV Easy DJ.exe
-
Size
1.3MB
-
MD5
e8de811d6b7c5b3c20fb7c6e1dc94098
-
SHA1
4e377234eb01bf046a5ee91b990f349df1380cf6
-
SHA256
a6b9dc65fa13def90da5ca63825d909a0bfe8adb4511e4f6cb26424ec89bf7b1
-
SHA512
47ce00c84c43516a637d9862ffdc10ea3a15d553c46727ce48327dd38297fa65bb45d0f991f65a7fc01f0ae9b1530e09eadf7faaa85860fb34c7d7142ff1d9c7
-
SSDEEP
24576:V8xzdrJ15D7RAEOvhq0TN0O5Xa3pYrQ5V0hXeSjo/Kp0:mJ19RAEOvhEpD5+ZUy0
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AV Easy DJ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DXEffectTester.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 744 AV Easy DJ.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 4180 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4180 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 744 AV Easy DJ.exe 744 AV Easy DJ.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 744 wrote to memory of 1616 744 AV Easy DJ.exe 85 PID 744 wrote to memory of 1616 744 AV Easy DJ.exe 85 PID 744 wrote to memory of 1616 744 AV Easy DJ.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\AV Easy DJ.exe"C:\Users\Admin\AppData\Local\Temp\AV Easy DJ.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\Effects\DirectX\DXEffectTester.exeAvnexDXTestFileObject7442⤵
- System Location Discovery: System Language Discovery
PID:1616
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x490 0x33c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98B
MD5a0900e88e7b6a8d2054b638426ca9533
SHA129eb0baa84449933dbec57c3657aa3906bfdc8c1
SHA256b0f2ff41b36d0e1ab94d88a8d8d4bb185c100f1f7d69ae4cf12aa43adc328dbc
SHA512653216462f4d7000deb136fefdc7aeca99139c8392870a6bb3d9d5500861097d7b8eb7560c5c3503b060c95747ca013a429e2f19bf66e8c7d9362e6407c88e1b