Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-01-2025 01:15
Behavioral task
behavioral1
Sample
idk.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
idk.exe
Resource
win10v2004-20241007-en
General
-
Target
idk.exe
-
Size
839KB
-
MD5
e2fb3738086afd9a87d5ac2a09d29948
-
SHA1
178434789820a0c1175ea70462bc2a6b57a008e8
-
SHA256
52dc6a546bfb806822f34b61fcaad4c6cf80b983bd97ed598c44a75087828bca
-
SHA512
83b3bdc1d4bb1addfe3ef1f7edae078c8c1352d01bb0038ca9ffc27bf84c037886a22333cf554060022e3a126e84c6d9d9701ad6fbb32613fc8e142b981f23d0
-
SSDEEP
24576:LpS04YNEMuExDiU6E5R9s8xY/2l/dmtnIbt+r6:LL4auS+UjfU2TmdIbt+r
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation idk.exe -
Executes dropped EXE 1 IoCs
pid Process 3256 AudioDriver.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini idk.exe File opened for modification C:\Windows\assembly\Desktop.ini idk.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly\Desktop.ini idk.exe File opened for modification C:\Windows\assembly idk.exe File created C:\Windows\assembly\Desktop.ini idk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idk.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AudioDriver.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe 3256 AudioDriver.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3256 AudioDriver.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3256 AudioDriver.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3256 AudioDriver.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1520 wrote to memory of 3256 1520 idk.exe 82 PID 1520 wrote to memory of 3256 1520 idk.exe 82 PID 1520 wrote to memory of 3256 1520 idk.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\idk.exe"C:\Users\Admin\AppData\Local\Temp\idk.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
839KB
MD5e2fb3738086afd9a87d5ac2a09d29948
SHA1178434789820a0c1175ea70462bc2a6b57a008e8
SHA25652dc6a546bfb806822f34b61fcaad4c6cf80b983bd97ed598c44a75087828bca
SHA51283b3bdc1d4bb1addfe3ef1f7edae078c8c1352d01bb0038ca9ffc27bf84c037886a22333cf554060022e3a126e84c6d9d9701ad6fbb32613fc8e142b981f23d0