502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753

General

Target

502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe
Size

839KB
MD5

98a5ba2b1804e05fd8d361429c538d5e
SHA1

ff979f68614cdddf6db17ff574a51153fd6358bd
SHA256

502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753
SHA512

ad7ac8fa9511b973dbf5cd691a6d2ebb265e9eeb8549872751d89e8f8f71ca70a8dcc6e5cfa7b678d6cd9ce61096d5536792eb53244eff08ae0ee8fc91b3a478
SSDEEP

24576:yFS04YNEMuExDiU6E5R9s8xY/2l/drtnIbt+rd:y34auS+UjfU2TrdIbt+r

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe

Executes dropped EXE 1 IoCs

pid	Process
552	AudioDriver.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe
File created	C:\Windows\assembly\Desktop.ini	502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AudioDriver.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe
552	AudioDriver.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	AudioDriver.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
552	AudioDriver.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
552	AudioDriver.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 552	4556	502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe	82
PID 4556 wrote to memory of 552	4556	502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe	82
PID 4556 wrote to memory of 552	4556	502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe	82

C:\Users\Admin\AppData\Local\Temp\502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe
"C:\Users\Admin\AppData\Local\Temp\502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe

Filesize
839KB

MD5
98a5ba2b1804e05fd8d361429c538d5e

SHA1
ff979f68614cdddf6db17ff574a51153fd6358bd

SHA256
502302c8b6270b082df08e81c96bde54a220bd6ae2a8ae3b08100529e2a7a753

SHA512
ad7ac8fa9511b973dbf5cd691a6d2ebb265e9eeb8549872751d89e8f8f71ca70a8dcc6e5cfa7b678d6cd9ce61096d5536792eb53244eff08ae0ee8fc91b3a478

Download Submit
memory/552-18-0x0000000074B60000-0x0000000075111000-memory.dmp

Filesize
5.7MB

Download
memory/552-20-0x0000000074B60000-0x0000000075111000-memory.dmp

Filesize
5.7MB

Download
memory/552-21-0x0000000074B60000-0x0000000075111000-memory.dmp

Filesize
5.7MB

Download
memory/552-22-0x0000000074B60000-0x0000000075111000-memory.dmp

Filesize
5.7MB

Download
memory/4556-0-0x0000000074B62000-0x0000000074B63000-memory.dmp

Filesize
4KB

Download
memory/4556-1-0x0000000074B60000-0x0000000075111000-memory.dmp

Filesize
5.7MB

Download
memory/4556-2-0x0000000074B60000-0x0000000075111000-memory.dmp

Filesize
5.7MB

Download
memory/4556-19-0x0000000074B60000-0x0000000075111000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing