63b2109d651e58bdceb6dcd68821e723f4a5ce45875405cf395ff04937ea26b8

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f6a6c80412876ea03ad4f91bde1f4f9.exe
Size

441KB
MD5

9f6a6c80412876ea03ad4f91bde1f4f9
SHA1

fc790ac37fe77fee5fb4f38faea0484735bca3ac
SHA256

efb79eb15122d2db2c044077ec6b477ddcb468cf643a4373be39d745a010f3d7
SHA512

75af93120e1c0e4ff8eb53697457c59dd9c3344c160010674a9794831b36ad327268bd4d2487d5e64d3e8350f72657513e2318d7f204149ddcf450c04441382e
SSDEEP

1536:N4eK+IFjWfoPbuaTRM3nFkwHbaA3LL0idWwiQcmWkF7jV:G+IF6foPCaTRMXbaev0FQcmWkRV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	9f6a6c80412876ea03ad4f91bde1f4f9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-805952410-2104024357-1716932545-1000\Control Panel\International\Geo\Nation	audiohd.exe

Executes dropped EXE 1 IoCs

pid	Process
3004	audiohd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f6a6c80412876ea03ad4f91bde1f4f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiohd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3700	9f6a6c80412876ea03ad4f91bde1f4f9.exe
3004	audiohd.exe
3304	powershell.exe
3304	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3700	9f6a6c80412876ea03ad4f91bde1f4f9.exe
Token: SeDebugPrivilege	3004	audiohd.exe
Token: SeDebugPrivilege	3304	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3004	3700	9f6a6c80412876ea03ad4f91bde1f4f9.exe	87
PID 3700 wrote to memory of 3004	3700	9f6a6c80412876ea03ad4f91bde1f4f9.exe	87
PID 3700 wrote to memory of 3004	3700	9f6a6c80412876ea03ad4f91bde1f4f9.exe	87
PID 3004 wrote to memory of 3304	3004	audiohd.exe	88
PID 3004 wrote to memory of 3304	3004	audiohd.exe	88
PID 3004 wrote to memory of 3304	3004	audiohd.exe	88
PID 3304 wrote to memory of 1484	3304	powershell.exe	90
PID 3304 wrote to memory of 1484	3304	powershell.exe	90
PID 3304 wrote to memory of 1484	3304	powershell.exe	90
PID 1484 wrote to memory of 3940	1484	csc.exe	91
PID 1484 wrote to memory of 3940	1484	csc.exe	91
PID 1484 wrote to memory of 3940	1484	csc.exe	91

C:\Users\Admin\AppData\Local\Temp\9f6a6c80412876ea03ad4f91bde1f4f9.exe
"C:\Users\Admin\AppData\Local\Temp\9f6a6c80412876ea03ad4f91bde1f4f9.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe
  "C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -Path "C:\Users\Admin\AppData\Local\Microsoft\local.cs"; [LocalServ]::Listen()
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vef430rt\vef430rt.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2F2.tmp" "c:\Users\Admin\AppData\Local\Temp\vef430rt\CSC9CB55DDDEBEF49AAA7322D2F9E2D3129.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe

Filesize
450KB

MD5
418c28fc49a8c5e0ee1791faec6bd7bb

SHA1
b4a00179d84bb3817f681709c236c4edd9617262

SHA256
c95e966ef4e712de2abc283d3ad615f5b5cc88fcdb33d9cdd9b946eb11b66dab

SHA512
6efb31e7e597a86b32e7a3f50ec644cebf4870331e8d64025227f7d7d51615aecbada50641acdddfb71af942e72d19931e74182de054c89f7eed3801bb850b67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\local.cs

Filesize
4KB

MD5
ff169c4274b91df68a1a0548b9186b29

SHA1
e2a406a1a49c5825d4f4279e82d1ca369433b244

SHA256
6da3e26b268e4a6c21e192c8b9a1b89aef6880bad673b79e6a889d29641ac2cc

SHA512
8785d91046722c0e8278fb95404ae284c3cf5e96060d06a7dc2209866b96618978e41844759da30fec7bdcef677fada61d3db498adbe989eaa87fbf84fc3366b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESC2F2.tmp

Filesize
1KB

MD5
57d31f83ade1e59d64ff7e89ee3514c7

SHA1
3783a8d1ffe3a130904ae3a3a54bbfda8aa81ed9

SHA256
80ae3dc4cc2ea0190a6cb25ef68c3e0aea583532545aaac6934ee426f3c109b8

SHA512
9f2ef968d5fc2677a8a0ac732cc38a092652a871e52bab0e726bb1f9f8ca0d0e68d9d6598a177e82c14d051bbde1515953857e26cb10ff99ae792e9fba3633f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lyre3s1g.z4o.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\vef430rt\vef430rt.dll

Filesize
6KB

MD5
e74061eeff67c027781d901421958444

SHA1
f17221a7272e79a872408b9e66ad78ea3c23ccf8

SHA256
0eb755a1602a282082a425576c0aa25c1cc8d9f64f9f698847984952e1d7787a

SHA512
54748d44452e788a758743b301d59819e957f3ec3846f3be20c6480db7e8e34a09f41452c7d2233691596ac6e62f87472d4f745951a0ac472faafa608993608a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vef430rt\CSC9CB55DDDEBEF49AAA7322D2F9E2D3129.TMP

Filesize
652B

MD5
602f351913218e916eabe6ce6283fea8

SHA1
6a284fa389758b96579214a55c9bdc82c076c1f0

SHA256
05183352f1cff6af29b57b35bfbacc38181e2789c08571909e831ca52cfbf0b4

SHA512
f06cac2c8a45d675e44a6a293089fe3c71fb52126d01bf5aa0ab297e51bda9958bd1aa142baa0b99e2e0854e12cd6ecb8ac6839fc379597c7fb72df0efe2f84c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vef430rt\vef430rt.cmdline

Filesize
360B

MD5
200951adfc9b051e0982a6fc6954bbf4

SHA1
1b8c0b6fc5721b7681b1f25730d723eea1f5fecc

SHA256
9b4e8211bb487e43fc5d1125dc6fe9c361e5925fd08995b00dcb6fefd353d1b9

SHA512
3aa0195cd65f95924fc4e47b3481c79da3c86f740cdd64bc3d55b58e414ec70191999bc6613ee3e62b820220772e05cad9de9b49ea1bc4abd28a719e4af74f3e

Download Submit
memory/3004-16-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3004-55-0x0000000006090000-0x000000000609A000-memory.dmp

Filesize
40KB

Download
memory/3004-57-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3004-56-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3004-54-0x00000000069A0000-0x0000000006A32000-memory.dmp

Filesize
584KB

Download
memory/3004-17-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3304-37-0x0000000006300000-0x000000000631E000-memory.dmp

Filesize
120KB

Download
memory/3304-38-0x0000000006320000-0x000000000636C000-memory.dmp

Filesize
304KB

Download
memory/3304-29-0x0000000005C80000-0x0000000005FD4000-memory.dmp

Filesize
3.3MB

Download
memory/3304-58-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3304-22-0x00000000054D0000-0x0000000005AF8000-memory.dmp

Filesize
6.2MB

Download
memory/3304-19-0x00000000029E0000-0x0000000002A16000-memory.dmp

Filesize
216KB

Download
memory/3304-20-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3304-21-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3304-25-0x0000000005320000-0x0000000005386000-memory.dmp

Filesize
408KB

Download
memory/3304-26-0x0000000074740000-0x0000000074EF0000-memory.dmp

Filesize
7.7MB

Download
memory/3304-24-0x00000000052B0000-0x0000000005316000-memory.dmp

Filesize
408KB

Download
memory/3304-39-0x0000000007A10000-0x000000000808A000-memory.dmp

Filesize
6.5MB

Download
memory/3304-40-0x0000000006800000-0x000000000681A000-memory.dmp

Filesize
104KB

Download
memory/3304-52-0x0000000006890000-0x0000000006898000-memory.dmp

Filesize
32KB

Download
memory/3304-23-0x0000000005210000-0x0000000005232000-memory.dmp

Filesize
136KB

Download
memory/3700-1-0x0000000000D60000-0x0000000000D76000-memory.dmp

Filesize
88KB

Download
memory/3700-2-0x0000000005C70000-0x0000000006214000-memory.dmp

Filesize
5.6MB

Download
memory/3700-3-0x0000000005760000-0x00000000057FC000-memory.dmp

Filesize
624KB

Download
memory/3700-0-0x000000007474E000-0x000000007474F000-memory.dmp

Filesize
4KB

Download