Analysis
-
max time kernel
51s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06-10-2024 10:30
General
-
Target
audacity-win-3.2.5-x64.exe
-
Size
13.7MB
-
MD5
36a195ba95270d76f105b3cf7aff4a4f
-
SHA1
05cdc660d848b7ed2bc4f58e8a5532cd7a98af69
-
SHA256
a0a34facbcc28dbe0b6905b29f6aa17353d40383214414e5693d4640f5e4527d
-
SHA512
1d1c142737cf4188ad34518a474c7e68b6361ccbf2e89c5dd773c3a678451c9bb55cd8be2d02a4ca4bd5b59104171cd85e33f28a1629ec7d11c51cda30dbb04c
-
SSDEEP
393216:MNwu8pVRbrRZZDWMmzOXBerWqJ5Sb/RgYAfEo:vu8VRRZZKMXXBGimYxo
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 14 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\audacity-win-3.2.5-x64.exe"C:\Users\Admin\AppData\Local\Temp\audacity-win-3.2.5-x64.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-LG087.tmp\audacity-win-3.2.5-x64.tmp"C:\Users\Admin\AppData\Local\Temp\is-LG087.tmp\audacity-win-3.2.5-x64.tmp" /SL5="$A0150,13278255,956416,C:\Users\Admin\AppData\Local\Temp\audacity-win-3.2.5-x64.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-5SRLC.tmp\_isetup\_setup64.tmphelper 105 0x2403⤵
- Executes dropped EXE
-
-
C:\Program Files\Audacity\audacity.exe"C:\Program Files\Audacity\audacity.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14B
MD595e15c085988c0b3a0435448b51e2198
SHA1696863b3211762c9f2eeda7882e34e808eee95ab
SHA25629e4d55e0c05be59bcbc7606a5bdfb3dfa54db83624323a72abec6800b8db97d
SHA512edcad00dc92d3a8b2ce3707c38079570a43a93798d7bafd031cb99864f6f2ec2ac8feaea13b4830062ff9346fae1ea03bf680a55d0d379a63e47950cee11f143
-
Filesize
356KB
MD55bd3e8c91d4c21b6dd6d2a04000b0f1d
SHA11216dee267146334351512ce18e41ec0d53cf6ee
SHA2569b82f1deabc7f0ca7fc559cf714ae28d9b7da8769f51030d77b4f01ad32d00ef
SHA512a565c34e2462f9a013d6f02e4cd89adae37d9d861e5c352c1fe09bdba2c37d04fd43fe86d34974e63c7184ae2e2952aaa74cc6464b023fcafb60be2734d6fea9
-
Filesize
566KB
MD5a62a22c33ed01a2cf362d3890ffa70e1
SHA1ea3f55d92cdcb788876d689d394ec3225b1d222c
SHA256003da4807acdc912e67edba49be574daa5238bb7acff871d8666d16f8072ff89
SHA5127da909a6c5dc26631fec8a382d5cb677d3aabf5b5c4e98b545c120685f879adcef8cc98e7bf74d37f7fc24b0f18999780d70aa28061f50adf6b28f19ce06930a
-
Filesize
346KB
MD5ca1b2129c1942f4be224511f2dc229cd
SHA1dfdfcd1ff0b9ce808c2cd5b04153fcb3ee68c195
SHA256373acfe12864ae3bcc5c025835cb8db7d70263350e88cc5c3f2ac4f9aa64cd5a
SHA51265b3877f17ffea0a5c308b12cd3bbdb411b6f25fe6a7a96f0cdc12335604fa2993a14a6854ee5b6ab1b58712bf6bdd3cd2d2892783d8eb85bfc23c183313fc7f
-
Filesize
121KB
MD5f138a44bef8e21ffae416b6ce3d60bbf
SHA1bfdb598acf2f2418a607c96290b647b33983bb0e
SHA2568217bfb46f11c2e91976dd765999321699f4c666e2c0f468e6635f0a0a3bff11
SHA512dcac03afa96d6285dd83db770e5770f0f8bc224dcbddb01a617236052c9ade95ccadef6a9e0b4b29bcf416beba2a68e88100ef07f284765083fcebfc3d21c176
-
Filesize
128KB
MD5aa0ec1d3b7c7fb6e04a7671ed78d484a
SHA17c6fc0858576350e2c29660f927d32d15ada90f2
SHA256135a8874dbfcba0a0a4e02386f78cc35a70e5dbd9ba1b0abc35c387d10666ace
SHA51281cdaf8c3b4ed5fa9c2f6e3e801d9aa1d6efb975068ff1f96c7e83283555311aece3df445e486709750db0fb644acc07ffa63fdde8db5808c1185ba77fd24398
-
Filesize
323KB
MD51516b9ee9a6f6fbe15828960edb8ec3f
SHA165ae0b59fe7a62f6c820d0133c9d5422620bc63f
SHA2568b3d47d60afc5f01ce780ae36277636490abae9423768d9a3e679ba77f43fc8b
SHA5121ad5def7bc8789bb6bac48722c1142a6ade69e85b0559ab646d3a4c7f90bf65af1db0c9f39323a5ab0afb595a85032640c96afa17ecc25e59b0a21d7f362f2ac
-
Filesize
11.0MB
MD5a00cf7dd6ab907132c95f91287951462
SHA167ba706bf12f757afc49a4e30ccdc92338abcddb
SHA256b2db054d7cd2c66c1210269efe5f6f544b9fa0edffec2825091cac8df3b652c9
SHA512e9118b09df8ac2df5c9aced613b6e000a45685d0f56ab2ec3ce07d46a2d0dcb18a5b08687e2665c586e5c17f97ce5a4eb338e518dcd9d8fce11d0121bfd91ef8
-
Filesize
17.6MB
MD57164ff9558fb6569cb28338f121c67f8
SHA1c32f87aa30de7e90279631c49a6c2ce293ba8444
SHA256b4d2e903e0a0ad313425c0f8f304f8db78db9420b00659f631f88dc693e2c36b
SHA512851768ffd747379ffb04a05135b0ebf57f783715adf021b22df6933df2ce174de8895479e3f9de48be57da8b8d9b0921e5d6feb9dd5d8befe70809cc676b7e97
-
Filesize
217KB
MD5edacff7e3030f1ed31256cf6ce0bbd25
SHA1114a5a2c629d8aa8ff2cce7f0d61c8069d52e5c6
SHA256d5c17973de3c9cd35f1495a0d51b9492396b46eef100de6bac39f71ec8d0495a
SHA512be233c9276da3ccb9635a569dc978bd822639f53414fcbc63964f1e75766fa4acffa216cc4c556aa50a769a2b8d60aaa7eca8d07e77a1da1591ecdb285e72b79
-
Filesize
105KB
MD5e1c1a9c28be3b845df13802005695942
SHA173e73d5d47a72b4500f02eba615b6d6a7c0a33ee
SHA256eecd3239042a63b90c8ce71ca7dd0b879075ce5db6ae81d3c3cd897d74adf074
SHA512850dcae8d62301852586657f447ebe9909f5ba5669060127710eb661ae602c32ffc21ca391b03e0406332a72441b581cb4dbca7ecd81e56967c1cc411b9dbbd8
-
Filesize
70KB
MD53879a946d0f7a9f4534c4854d9a1abd8
SHA1844b98a256acc985207b77328ec416a636f86f15
SHA256304381ddb4dd2cb960757c304ef14ecb6e3ffb9b03b746065f26a43ef762e6f2
SHA51259e912717b54efbc4b5339a1a1323dab27b4fa5ec6877d7ce009077471bf7b5fb47cdf596f386cfdac3e4e0312b802437e51e1102b81c6c3b6c697520a2376b4
-
Filesize
76KB
MD53ca386f21d50f8fced57ccc0dd3d3724
SHA17b7d6b9bf6d043ffe48cceeff14cd7460151115d
SHA2566235cfba9233da19964444dc5a1fb6619f72d27ec0705c3a8c82ae2882b9ef4e
SHA512fce2f81e42dca542039591ee3d66938fc19dc0b8f0519a8c4201dee9b8bc62b1f67bdf67913ed99a7bc34cc3586b7cc36236d8d9169b66c56208c3f40922016b
-
Filesize
160KB
MD525e7146d078683f3cdfa433754725267
SHA1f0bcd2d09f14079bf5432c45a7cb9be00baaaece
SHA25694f008c45f831b596f3f63fbe6b8a8599143d13b37378af3f1106020a495afe5
SHA512dfae4b3cf5da9c0a74b6d9530fb42b1fc64983a13c8c3578d236ad6ef3aac70af2cc3792f3c3dbfce34398809c21ed87237c65937d7c4b08c73880000db6627b
-
Filesize
208KB
MD5db694002f55b7bba34acfaeac27636dd
SHA1fd2f852fc0f17084e2fc2382a07fcad21ba3a371
SHA256e187bee03fdc11214c9d2d8232c92e617580b188422d12e2f39ac8bbaf9d2c02
SHA512d0d9d075c9e8fcf9ce755db6caec95dc49b3a6311108054a5b7b5b3a572f384ef2fa9b1ef9ddd41841e604c5cad2fe106b182fbbe38750d1a01c7fa8d751e877
-
Filesize
103KB
MD561ba7629cdde1d772343bcc141b9bbee
SHA15d404743fa9b51cba9090f0666643da8baa10bbe
SHA2568f44ede6a382bff832a4fd92a08211b8d28d880cfca86f0864adfb75bbd54d4d
SHA512d2bfeede27d3af34de4e55cfa0e8dabb9f623b7f3b4a7d8c5ceb3db59f09905c0eb2ad5b2783e863806225e1df6a34ebfecbcc5e5fe34432a44be372dcd1bba7
-
Filesize
130KB
MD59e9484531b01a49d0f5d72b25357b830
SHA189f62e9df47507a6a175852b7e8786a870b7cdde
SHA2568ef0460de81630cb9cd9c4f00acebc109d965c13b79242330e0db43ac829e159
SHA512e8c6c0b1ad64df1afddc940e36ec3cba29f1d43c28d69c76dc95b0d4e4c446852a6bc48a2ebdebb70306670f3111e2f8ef13718862f16b289ea0fe167e1a2d12
-
Filesize
152KB
MD5f88ac51cc32487e73091abdd2a612a78
SHA1ba54a60e71e8a0f6e0b0472c7bc8ebe46cfe38ff
SHA256db723617240b245a1e75b41d21ba0aa6aef0bc7acc91ec019547532a86e20aa4
SHA512226553034040f0dd694b75ef37d75da37700c60e53a39902e017ea687973236f00b5dedf03791b6cfd283434729878704573f6a56a55518b4dac42a114f350fd
-
Filesize
143KB
MD561b5db5a9ca547cec9b327a79f8a28e2
SHA182376299989ef42dcd7c5175f0e8f4f238a87842
SHA256b272dd8beb5fb7b446da2ae4d31fc4bd04b427436b4e2e9f68c81d5d69a34bd1
SHA5129f3841f84b8b7839ff00c006030baae7492d7e4c1a9142a885daff4078c06ee7572fbdaca96ec77820ca1f3eb24caaec093ca18e4ab3c774767929b4af7e01d1
-
Filesize
2.2MB
MD57cc4be6e764d4044f1343b4ff3d52507
SHA1565eab161bd418661c7243e601dbc72fe2b7fe0d
SHA256196d4f5845add8884c202a1140ace25608b708b972b80427838b5bbe1ff4c5a3
SHA512e61034bf81d23eb8e5b72747801e250dadaf4d2e405cfe429fd862c333125dc099e46e5fd4c850c5f61e74a6baaf375fd5798a16bf66dcf4a105e0b4b1089bd5
-
Filesize
432KB
MD5804a965befeee7e2ee3494e5786479f6
SHA1eea1342cdc520ce82584b70ed38fb32016c6cf7c
SHA256366eda8b99c56bfaead3acb3e2d55250e04c21170a111ee15b38dd5b241f91d7
SHA51218f059437c259661bcfdd7e911bb85de4c50caf0c82ac0cb0d1fe313377392b0fac38e22ef08db43ace99b8f17dff9e3847fa0fd715cc7b97a668a2f8c02f287
-
Filesize
83KB
MD5d379245c37b8301502abf8debd33e800
SHA1640945d8ea8429e1556e03db7486dd453f9de974
SHA256525dac13edc4dfb8cc6adf587ca69db8a6a0bc28eb6536a7884e77c8326c5bf0
SHA512c3975293aa9e6d3c7d7521d47a24dfccf998b251fc25087d52dd7dd3824d54556704a7239028ff2ba3083710d746f1fef51852df51d87d03f1fea0f948a021d4
-
Filesize
173KB
MD5dcb2ea82b4469a98b359e0dd3de7ef91
SHA1fca41991a775149919742b13dd824ed58ddb867c
SHA25605c832ea0f204adc3ab5d4ac047bcb4fb905af0628accd91804f97940b1da40b
SHA5121ec981e1e7eba3eb10441a42afba90ce23a743632d1e326ccd25ff0c8f2721d1a6dc98f88bffab0140cd32195805ee562970c4b73027a99a64646ed23cc34613
-
Filesize
197KB
MD561958469416a249f373c3b42a23a687e
SHA114a8c41d7eb22b94e03abf0f3b63379ed597ef50
SHA256aa0f362fd797433ba4168fe86db5e39ba277fca4dbb7bf8f3953902861a476d3
SHA5120669f5112ad749bdf9080a9b91103eb637ea65768dbd15f4d311ec486c5fe78880b2d507127e0c418fabb4511d7a8c5b055dd8512109816c2d3d39b13cdc886a
-
Filesize
224KB
MD54ba55a748860dfc6b6c2752bfa5c0da9
SHA1f388a61a204b2666de27587ce6a00bf356ee8619
SHA256adab0d5600cd8480b8ca81a98f7cd5aa3e0f73fa58e5ebd78a08cba1cfc27dc9
SHA512b89d6ed45f9b4808fc10294274959a7782dc50c8e132467adeb2788a26e1a809b430d6d097865ed71bd8e012067806e38ab2963d67d0cd64a56f54539d57df79
-
Filesize
106KB
MD54585a96cc4eef6aafd5e27ea09147dc6
SHA1489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA256a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
SHA512d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
-
Filesize
48KB
MD57e668ab8a78bd0118b94978d154c85bc
SHA1dbac42a02a8d50639805174afd21d45f3c56e3a0
SHA256e4b533a94e02c574780e4b333fcf0889f65ed00d39e32c0fbbda2116f185873f
SHA51272bb41db17256141b06e2eaeb8fc65ad4abdb65e4b5f604c82b9e7e7f60050734137d602e0f853f1a38201515655b6982f2761ee0fa77c531aa58591c95f0032
-
Filesize
3.6MB
MD52a2a685b0f6a7f854d6892d8e9deb34b
SHA160466e9ddc2b4c58886685769c15adf935f6cfb1
SHA256542a09cbda64837a0f75d4f115ac00217f97a5e723eb5f19ada4b75a57848e70
SHA51260b0243005e3fdee54184e72c226016d7e44cde7cbcf72d0025e5c3c3fb89718625d258303d8f2f7d95fa832c8283acb7416a0bb9f90cf484be3591737c30f63
-
Filesize
135KB
MD570625e2e8fa03a7954be3714cc34363f
SHA1f61040b12b941bab1f0044c0ae93100e30f7b6c6
SHA256d860db3d34c3f97b7fa415855bdce56fe5c382f4e1a72d64cdffb1790b0567ce
SHA512743eb12b274a3b71b8b3f0f87d59a012e62f06220ae11b1973ee4377aa16868d9794a19c386a265a068f7d0c076a23c01f72f58b8335cc63c613339f4d9a8876
-
Filesize
6KB
MD5e4211d6d009757c078a9fac7ff4f03d4
SHA1019cd56ba687d39d12d4b13991c9a42ea6ba03da
SHA256388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
SHA51217257f15d843e88bb78adcfb48184b8ce22109cc2c99e709432728a392afae7b808ed32289ba397207172de990a354f15c2459b6797317da8ea18b040c85787e
-
Filesize
3.2MB
MD541d3b6f8ac76b925eff1336366951143
SHA1b900bcfdbe890a677a63f156224ede7573041405
SHA256e002a44d461883d8634f8920b5d3d27e69841b75df9eb08f95d092780149265e
SHA512fd4dc29afb487fa8de6169f834c693578482e107cd32cc3041a33adde3696c9fc713316d156089f0b37f7e723cc0808c67745c06f3122b001b05daf5ea473b9e
-
Filesize
11.2MB
-
Filesize
18.3MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
728KB
-
Filesize
988KB