545403ae8941712ac4f021d5867ac8df35a554d5754192c54da66f7b2a2d4e5f

Analysis

max time kernel
97s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69319ee8609b1c1eebe97dc2bdf84c9e.exe
Size

447KB
MD5

69319ee8609b1c1eebe97dc2bdf84c9e
SHA1

987502b1e9b0b2af58b783be6a098b390cbb5f0e
SHA256

b961c3fdb1102f0dd80ff834e302b199be728cbf7998aa0b263982e8770b71cc
SHA512

a2a1b2df6d992ec7b32643856dfd50088b8b88052992dda54f2e96446854dcb18854eac591e0c93991a4c1a99ec278bd05245128760e542c8dc078c97f7fb476
SSDEEP

1536:N4eK+IFjWfoPbuaTRM3nFkwHbaA3LL0idWwiQcmWkF7jV:G+IF6foPCaTRMXbaev0FQcmWkRV

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1340	audiohd.exe

Loads dropped DLL 2 IoCs

pid	Process
2596	69319ee8609b1c1eebe97dc2bdf84c9e.exe
2596	69319ee8609b1c1eebe97dc2bdf84c9e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69319ee8609b1c1eebe97dc2bdf84c9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiohd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2596	69319ee8609b1c1eebe97dc2bdf84c9e.exe
1340	audiohd.exe
1940	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	69319ee8609b1c1eebe97dc2bdf84c9e.exe
Token: SeDebugPrivilege	1340	audiohd.exe
Token: SeDebugPrivilege	1940	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 1340	2596	69319ee8609b1c1eebe97dc2bdf84c9e.exe	30
PID 2596 wrote to memory of 1340	2596	69319ee8609b1c1eebe97dc2bdf84c9e.exe	30
PID 2596 wrote to memory of 1340	2596	69319ee8609b1c1eebe97dc2bdf84c9e.exe	30
PID 2596 wrote to memory of 1340	2596	69319ee8609b1c1eebe97dc2bdf84c9e.exe	30
PID 1340 wrote to memory of 1940	1340	audiohd.exe	31
PID 1340 wrote to memory of 1940	1340	audiohd.exe	31
PID 1340 wrote to memory of 1940	1340	audiohd.exe	31
PID 1340 wrote to memory of 1940	1340	audiohd.exe	31
PID 1940 wrote to memory of 2772	1940	powershell.exe	33
PID 1940 wrote to memory of 2772	1940	powershell.exe	33
PID 1940 wrote to memory of 2772	1940	powershell.exe	33
PID 1940 wrote to memory of 2772	1940	powershell.exe	33
PID 2772 wrote to memory of 2624	2772	csc.exe	34
PID 2772 wrote to memory of 2624	2772	csc.exe	34
PID 2772 wrote to memory of 2624	2772	csc.exe	34
PID 2772 wrote to memory of 2624	2772	csc.exe	34

C:\Users\Admin\AppData\Local\Temp\69319ee8609b1c1eebe97dc2bdf84c9e.exe
"C:\Users\Admin\AppData\Local\Temp\69319ee8609b1c1eebe97dc2bdf84c9e.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe
  "C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -Path "C:\Users\Admin\AppData\Local\Microsoft\local.cs"; [LocalServ]::Listen()
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\slhp5gcx.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD20.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCD1F.tmp"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\local.cs

Filesize
4KB

MD5
ff169c4274b91df68a1a0548b9186b29

SHA1
e2a406a1a49c5825d4f4279e82d1ca369433b244

SHA256
6da3e26b268e4a6c21e192c8b9a1b89aef6880bad673b79e6a889d29641ac2cc

SHA512
8785d91046722c0e8278fb95404ae284c3cf5e96060d06a7dc2209866b96618978e41844759da30fec7bdcef677fada61d3db498adbe989eaa87fbf84fc3366b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESCD20.tmp

Filesize
1KB

MD5
f555cda6cea1a845fa89a59c67952f94

SHA1
3f002e05531cd6fc06154161a1f60ebbc0909ce9

SHA256
90fd7926518f149651b23eb7ce5f896fcdb289607d629e28404a36d555c75b94

SHA512
642cc60f5fdc8220809030189b9e25af01ab51d91ade0f49c0dd6a5cbf4c836e03353ff3c6526895b72cfb4532ce927196f3d09f33c1c96779b5a5fd5bde3f3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\slhp5gcx.dll

Filesize
6KB

MD5
1f48edd97544955f622f974a807387a7

SHA1
2093d6c9e836c8e0a26289c7f50cae77d7079a59

SHA256
6416d3d7c36f58164010ebef653595f26e46b3c32cd5a4ae1cd272b7ca8c3bbf

SHA512
c2baef7775372b6bf903eb2091b387b75139bba427a96c38a2daad1e5315c9f4504f94250a1e2a596f947f4ee71f2a176fd387986d46159372cd1f15508a7fc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\slhp5gcx.pdb

Filesize
13KB

MD5
6b8afe61f26fac1e5993c5c0ca715b56

SHA1
d19490280558a556e5c8220bdec3f49852ed7c8a

SHA256
b98d1eefa7a2d174113c810666193bc8f6f6419f051aa2a90496b8f9c882d9a4

SHA512
fdde466bc074139c271f90193d7531e6b9c027981507b4a1dcafcf1c779385dcc2273cd39f37b76e4c21fb5b644e386f03f33521e42aee94bdfbf95d674b713e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCCD1F.tmp

Filesize
652B

MD5
221509789ce0baa09572c673c484109c

SHA1
709a87bacad9f0936f13b2ece597118fd4bc50cb

SHA256
994967c5f2797379a716f2d9b9ed57307b677ccd9e68aa9337360c0ad2acfdc0

SHA512
2c6da07eb9ac2dfe3a507dd74e60bedac921a4ce912e3b252bdee0108c82f0db568f947f81c19d15d47465bab35180e4c82d0b0763ef579dcfcd047b554d9ab5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\slhp5gcx.cmdline

Filesize
309B

MD5
6b956ba2dcacef2f07013abc1bcefdec

SHA1
df5ed8114ad4cca56f4e05a5fca95a4e4d616e48

SHA256
d9fc5e569d7d4facc4966196c22a2327d64ba68e6005c3e6c0a9c175cdae497b

SHA512
6ebffd7cad9aa820e8fac034a82c736292baacf0230d52dad8d8a0c8777c4ca0600fc01c2f1bc4efe1bd5927c3143cedd0f5cdd4114203bb9ed717e330c500d1

Download Submit
\Users\Admin\AppData\Local\Microsoft\audiohd.exe

Filesize
456KB

MD5
cac9e08ee45feb18d62df834087b096f

SHA1
544a6294678246938299f2b6c4d16901805fc125

SHA256
0f4ed04388fb64c700c27514317f3990b1552b3bd2764cc8cd9e13557ff69cc2

SHA512
460a10d94f5352e7d1247de2dbf497bc4ebd6ab066ae9125709ad14e12aacfb9697ed4d2c7d02106073c2f4a18995efb8d80f3f8a366c3eb65234166dbc35a63

Download Submit
memory/1340-12-0x0000000000CC0000-0x0000000000CD6000-memory.dmp

Filesize
88KB

Download
memory/1340-13-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/1340-14-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/1340-32-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/1340-33-0x0000000073EF0000-0x00000000745DE000-memory.dmp

Filesize
6.9MB

Download
memory/2596-1-0x0000000000E70000-0x0000000000E86000-memory.dmp

Filesize
88KB

Download
memory/2596-0-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

Filesize
4KB

Download