a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9

Analysis

max time kernel
125s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9.exe
Size

36KB
MD5

426a5925049abd828e5cbb398e2c49f5
SHA1

ac06534cedb202fc85cf7bf00feefbc4a50d02e5
SHA256

a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9
SHA512

a4a898f6cde880f80a432920b716219e2624cf66baa758d34962d72e4e287ba28784309b48230221ba805a3c7c13234e780c9917d3c623e01c994f69d2ac6b68
SSDEEP

768:ga1gqztfYolsHIWNrofnGuuLxaD4jwlKeoxgx3RnvGezOGpHpYWWyeq:gugqzmolsHIiofGuuED4CJowhnH5Jiy1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2408	a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	536	AUDIODG.EXE
Token: 33	536	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	536	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2408	a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9.exe
2408	a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9.exe
2408	a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9.exe

C:\Users\Admin\AppData\Local\Temp\a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9.exe
"C:\Users\Admin\AppData\Local\Temp\a7d4822ccbd4862c5ae7a541f313386360b84d40b7225b8e8a46618cbc09f5f9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2408

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1a8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2408-2-0x0000000003EB0000-0x0000000004F12000-memory.dmp

Filesize
16.4MB

Download