4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6b79788476c3806befcdd2dead8231a.exe
Size

506KB
MD5

f6b79788476c3806befcdd2dead8231a
SHA1

56eba5da31c728dc287435a555e527b1a27cae37
SHA256

9c798b5cf50fd400ce59355b91a741ab5ccfcffdaedc50815981fa280f4776a9
SHA512

f46f9b568f3d0cb6b4e799a68a3d7defd4e35cbf3df59840d05e575e8580a0cd8e95a497b5f5b272c21fe4105264272d4b58c8bec211597bbcf2de099eab49f3
SSDEEP

1536:N4eK+IFjWfoPbuaTRM3nFkwHbaA3LL0idWwiQcmWkF7jV:G+IF6foPCaTRMXbaev0FQcmWkRV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	f6b79788476c3806befcdd2dead8231a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	audiohd.exe

Executes dropped EXE 1 IoCs

pid	Process
4828	audiohd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6b79788476c3806befcdd2dead8231a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiohd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3272	f6b79788476c3806befcdd2dead8231a.exe
4828	audiohd.exe
2232	powershell.exe
2232	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3272	f6b79788476c3806befcdd2dead8231a.exe
Token: SeDebugPrivilege	4828	audiohd.exe
Token: SeDebugPrivilege	2232	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 4828	3272	f6b79788476c3806befcdd2dead8231a.exe	90
PID 3272 wrote to memory of 4828	3272	f6b79788476c3806befcdd2dead8231a.exe	90
PID 3272 wrote to memory of 4828	3272	f6b79788476c3806befcdd2dead8231a.exe	90
PID 4828 wrote to memory of 2232	4828	audiohd.exe	94
PID 4828 wrote to memory of 2232	4828	audiohd.exe	94
PID 4828 wrote to memory of 2232	4828	audiohd.exe	94
PID 2232 wrote to memory of 2464	2232	powershell.exe	98
PID 2232 wrote to memory of 2464	2232	powershell.exe	98
PID 2232 wrote to memory of 2464	2232	powershell.exe	98
PID 2464 wrote to memory of 2408	2464	csc.exe	99
PID 2464 wrote to memory of 2408	2464	csc.exe	99
PID 2464 wrote to memory of 2408	2464	csc.exe	99

C:\Users\Admin\AppData\Local\Temp\f6b79788476c3806befcdd2dead8231a.exe
"C:\Users\Admin\AppData\Local\Temp\f6b79788476c3806befcdd2dead8231a.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe
  "C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -Path "C:\Users\Admin\AppData\Local\Microsoft\local.cs"; [LocalServ]::Listen()
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ej3aotjb\ej3aotjb.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE128.tmp" "c:\Users\Admin\AppData\Local\Temp\ej3aotjb\CSC4359C810E12D4876AA59FF7A9B36B013.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe

Filesize
509KB

MD5
5479a668395bfc3673e3fbc6e69f6548

SHA1
b79e7f5e0b4637293370e6fa80552d9e7a0d5e0a

SHA256
dfc60ab9cb0765f6ac2919bee915b2eafafa14993b24dbe1cbab61473246541b

SHA512
f7fd52079596d829a85c466a18e2258de5d60acbdc7881e4b1dca3ef59f86ae9fe35cbff8bcde0b455b9df7a26bd6746720f8890f95d292c61557ccc03299a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\local.cs

Filesize
4KB

MD5
ff169c4274b91df68a1a0548b9186b29

SHA1
e2a406a1a49c5825d4f4279e82d1ca369433b244

SHA256
6da3e26b268e4a6c21e192c8b9a1b89aef6880bad673b79e6a889d29641ac2cc

SHA512
8785d91046722c0e8278fb95404ae284c3cf5e96060d06a7dc2209866b96618978e41844759da30fec7bdcef677fada61d3db498adbe989eaa87fbf84fc3366b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE128.tmp

Filesize
1KB

MD5
65183621207213824d775d3c2af22db7

SHA1
2d33db865b6899f6eb78915931cfdb65de44cd31

SHA256
069ff44691b99069613b3aa8848c4348419c3314dee6e9285d08d43e05d15105

SHA512
a302e371d5e2285e0e85f7cb185c1651b8ddae6ed9e39447cdbfcd7907e09f74573942aac4eeabe0988d0db3d9710afd0b340a4455a770d2c955937cac1ec974

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fkeidtcv.kbw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ej3aotjb\ej3aotjb.dll

Filesize
6KB

MD5
992f71fee439a2fcde61efa291d600b2

SHA1
4cef7da56211579975c0730955a9b8aa335601ae

SHA256
9baa56683af229287f31faee52267ff13617c567aa0c932ee73fc909fa46c559

SHA512
415233c18064c050d6249c8ef4ce1f5dd285eb774381c7b78bf8594350d273225da3b8d43b51533e8438fc1de507a3957f3b9539587239fa86c4d9a93e577800

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ej3aotjb\CSC4359C810E12D4876AA59FF7A9B36B013.TMP

Filesize
652B

MD5
f2408856df722727d58b8bd9a558b657

SHA1
c984e9fcf9860ef13befdbc7843bd5e5cc832c4c

SHA256
586836caebbb1434b1e9cbbf9e2e7a366a9b776c257b5cd26408b53691119fb2

SHA512
fd1e3e136327ea79a93f925c42e24e9265ce48c785c47d753d6b8dbce0eaa87a5e9dded0c944bf0ce5805cd48adc9856cadc4322b1f58de30dd7f100d7f19453

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ej3aotjb\ej3aotjb.cmdline

Filesize
360B

MD5
d65c4b010e08ec43f94dbd703315b398

SHA1
e6d689ca4944f98d9c3f74497fa68e0651bec312

SHA256
30b5f7d111dc3700a523c2a9b26c6afec97a91074d9aa4dca898e75a52420ca5

SHA512
b2156a7ba06b2f9be4f75859cc37eca47c4a2cd6dfa46738451344b73c47f5dc8e4559cc00a9ba8ac5372414d0ca3dea85f185b0dac1d2359d07a0f71afe1e7b

Download Submit
memory/2232-19-0x0000000003000000-0x0000000003036000-memory.dmp

Filesize
216KB

Download
memory/2232-39-0x0000000006E40000-0x0000000006E5A000-memory.dmp

Filesize
104KB

Download
memory/2232-21-0x0000000005BF0000-0x0000000006218000-memory.dmp

Filesize
6.2MB

Download
memory/2232-23-0x0000000005A00000-0x0000000005A66000-memory.dmp

Filesize
408KB

Download
memory/2232-22-0x0000000005960000-0x0000000005982000-memory.dmp

Filesize
136KB

Download
memory/2232-57-0x00000000750F0000-0x00000000758A0000-memory.dmp

Filesize
7.7MB

Download
memory/2232-34-0x0000000006420000-0x0000000006774000-memory.dmp

Filesize
3.3MB

Download
memory/2232-35-0x00000000750F0000-0x00000000758A0000-memory.dmp

Filesize
7.7MB

Download
memory/2232-24-0x0000000005A70000-0x0000000005AD6000-memory.dmp

Filesize
408KB

Download
memory/2232-36-0x0000000006940000-0x000000000695E000-memory.dmp

Filesize
120KB

Download
memory/2232-37-0x00000000069E0000-0x0000000006A2C000-memory.dmp

Filesize
304KB

Download
memory/2232-20-0x00000000750F0000-0x00000000758A0000-memory.dmp

Filesize
7.7MB

Download
memory/2232-38-0x0000000007FC0000-0x000000000863A000-memory.dmp

Filesize
6.5MB

Download
memory/2232-51-0x0000000006ED0000-0x0000000006ED8000-memory.dmp

Filesize
32KB

Download
memory/3272-3-0x00000000059F0000-0x0000000005A8C000-memory.dmp

Filesize
624KB

Download
memory/3272-2-0x0000000005E00000-0x00000000063A4000-memory.dmp

Filesize
5.6MB

Download
memory/3272-1-0x0000000000F80000-0x0000000000F96000-memory.dmp

Filesize
88KB

Download
memory/3272-0-0x00000000750FE000-0x00000000750FF000-memory.dmp

Filesize
4KB

Download
memory/4828-16-0x00000000750F0000-0x00000000758A0000-memory.dmp

Filesize
7.7MB

Download
memory/4828-17-0x00000000750F0000-0x00000000758A0000-memory.dmp

Filesize
7.7MB

Download
memory/4828-53-0x0000000006860000-0x00000000068F2000-memory.dmp

Filesize
584KB

Download
memory/4828-54-0x0000000005EE0000-0x0000000005EEA000-memory.dmp

Filesize
40KB

Download
memory/4828-55-0x00000000750F0000-0x00000000758A0000-memory.dmp

Filesize
7.7MB

Download
memory/4828-56-0x00000000750F0000-0x00000000758A0000-memory.dmp

Filesize
7.7MB

Download