bd9ea8b56ffc2ab9f8903d23d27007365b411ae06d207ec27252e894ecab7106

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

-lightroom 5 עkeygen/keygen.exe
Size

121KB
MD5

67766ceb8f827dd4e99af10d416ff893
SHA1

982ed4893d3e6d2dab652fac8a0dc0f4d52a06b7
SHA256

c666b29230f5c2c29a79830177e0dda67c13cd8cbea227d3c4beeb800a98fea5
SHA512

be5086467098605d008784b79e7937d622532be558d03cd744755137b223fa72aeeefc84612568ad4da4188c749584cee26bc6cb35eb9cf995133735af4235f1
SSDEEP

3072:A3p+0+TBU5RtJ4jhvawCf5h9zYRGDZ11wBnrlnhUmP:A3SmbtJevawCxh9zYUN11srZia

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	keygen.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keygen.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4452	keygen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3532	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3532	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\-lightroom 5 עkeygen\keygen.exe
"C:\Users\Admin\AppData\Local\Temp\-lightroom 5 עkeygen\keygen.exe"
1⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:4452

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d8 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\drivers\etc\hosts

Filesize
1KB

MD5
63ac5683c8f3b3e56d745fc5703447d2

SHA1
9f820feefe58177bfaea0721b10b44b9622473f7

SHA256
2b1e1f839137a4410387102d923d953f85a9edf9efd3cfa1b7989b4f4fdc2a6d

SHA512
633f48541e8d25a29ec70f192d145af0e067a5fc6db47aa00194861cdd923074b76d299a18e73cadc1ee5987a2f5bc2e147f181408c398bcf2e5f460a29b5b2a

Download Submit
memory/4452-8-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-6-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-18-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-5-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-21-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-0-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-9-0x0000000000401000-0x00000000004B1000-memory.dmp

Filesize
704KB

Download
memory/4452-26-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-11-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-12-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-13-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-1-0x0000000000401000-0x00000000004B1000-memory.dmp

Filesize
704KB

Download
memory/4452-3-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-2-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-10-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-31-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-34-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-39-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-42-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-47-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-50-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-55-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-60-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-63-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download
memory/4452-68-0x0000000000400000-0x00000000004D2836-memory.dmp

Filesize
842KB

Download