Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2024 01:03
Behavioral task
behavioral1
Sample
e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe
Resource
win10v2004-20241007-en
General
-
Target
e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe
-
Size
1.2MB
-
MD5
47441caa38be61a3170701bec1bdef0d
-
SHA1
330c1fd094183648f05012ba7960c532bfac8a6b
-
SHA256
e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7
-
SHA512
0743db465c52701985019edda5e74e95a719d5d4cdded6499adf47f127f7a10b04d96b727c029d5f33973b6c246c970ebdb1b40fc3d327099d69723888d171f6
-
SSDEEP
24576:tMS04YNEMuExDiU6E5R9s8xY/2l/d0J5dtsPxNGfpoIbt+rJ:tk4auS+UjfU2Tg5XDxoIbt+r
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe -
Executes dropped EXE 1 IoCs
pid Process 2900 AudioDriver.exe -
Loads dropped DLL 1 IoCs
pid Process 2900 AudioDriver.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe File opened for modification C:\Windows\assembly\Desktop.ini e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe File created C:\Windows\assembly\Desktop.ini e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe File opened for modification C:\Windows\assembly\Desktop.ini e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe 2900 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2900 AudioDriver.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2900 AudioDriver.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4724 wrote to memory of 2900 4724 e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe 87 PID 4724 wrote to memory of 2900 4724 e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe 87 PID 4724 wrote to memory of 2900 4724 e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe"C:\Users\Admin\AppData\Local\Temp\e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
626KB
MD5d8aec01ff14e3e7ad43a4b71e30482e4
SHA1e3015f56f17d845ec7eef11d41bbbc28cc16d096
SHA256da1d608be064555ab3d3d35e6db64527b8c44f3fa5ddd7c3ec723f80fc99736e
SHA512f5b2f4bda0cc13e1d1c541fb0caea14081ee4daffd497e31a3d4d55d5f9d85a61158b4891a6527efe623b2f32b697ac912320d9be5c0303812ca98dcc8866fcf
-
Filesize
1.2MB
MD547441caa38be61a3170701bec1bdef0d
SHA1330c1fd094183648f05012ba7960c532bfac8a6b
SHA256e863500142b6bebd270bc2b83aa4990f20b91541635a5ad34c3ddd0e439825b7
SHA5120743db465c52701985019edda5e74e95a719d5d4cdded6499adf47f127f7a10b04d96b727c029d5f33973b6c246c970ebdb1b40fc3d327099d69723888d171f6