Analysis
-
max time kernel
76s -
max time network
77s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2025 22:52
Behavioral task
behavioral1
Sample
idk.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
idk.exe
Resource
win11-20241007-en
windows11-21h2-x64
11 signatures
150 seconds
General
-
Target
idk.exe
-
Size
839KB
-
MD5
54e1acf7a7769c332fde3c497fc722ad
-
SHA1
b57224bc44bac62740b78fe86afa3a7fb83b901e
-
SHA256
bc0a1fcda7c1e2f33ac4ba5b4bf842c2c998d672c6cdd1855ffee526ae20f3f8
-
SHA512
74e4c93dfe8fa742726b321fd2de1be70bc7e710f6e9010ec2ca823ff2941ca00c51e52e5e2eabac6f8e19b0710bf8831746eb5d91eda15218bbe52dbcfe969f
-
SSDEEP
24576:6BS04YNEMuExDiU6E5R9s8xY/2l/dGtnIbt+ro:6j4auS+UjfU2TGdIbt+r
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation idk.exe -
Executes dropped EXE 1 IoCs
pid Process 232 AudioDriver.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini idk.exe File opened for modification C:\Windows\assembly\Desktop.ini idk.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini idk.exe File opened for modification C:\Windows\assembly idk.exe File created C:\Windows\assembly\Desktop.ini idk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 232 AudioDriver.exe 232 AudioDriver.exe 232 AudioDriver.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 232 AudioDriver.exe Token: SeDebugPrivilege 2200 taskmgr.exe Token: SeSystemProfilePrivilege 2200 taskmgr.exe Token: SeCreateGlobalPrivilege 2200 taskmgr.exe -
Suspicious use of FindShellTrayWindow 63 IoCs
pid Process 232 AudioDriver.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe -
Suspicious use of SendNotifyMessage 62 IoCs
pid Process 232 AudioDriver.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe 2200 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1972 wrote to memory of 232 1972 idk.exe 83 PID 1972 wrote to memory of 232 1972 idk.exe 83 PID 1972 wrote to memory of 232 1972 idk.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\idk.exe"C:\Users\Admin\AppData\Local\Temp\idk.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:232
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
839KB
MD554e1acf7a7769c332fde3c497fc722ad
SHA1b57224bc44bac62740b78fe86afa3a7fb83b901e
SHA256bc0a1fcda7c1e2f33ac4ba5b4bf842c2c998d672c6cdd1855ffee526ae20f3f8
SHA51274e4c93dfe8fa742726b321fd2de1be70bc7e710f6e9010ec2ca823ff2941ca00c51e52e5e2eabac6f8e19b0710bf8831746eb5d91eda15218bbe52dbcfe969f