4bcbb8983fe7425976c5a1789deff73fb138e80981f5ebfef1f835bcc6757760

Resubmissions

14/04/2025, 07:51

250414-jp1kfssjz9 10

14/04/2025, 07:46

250414-jl9nyssjt9 10

08/04/2025, 15:58

250408-tevasswl18 10

08/04/2025, 14:19

250408-rm2nqsvqw2 10

Analysis

max time kernel
900s
max time network
898s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2025, 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6b79788476c3806befcdd2dead8231a.exe
Size

506KB
MD5

f6b79788476c3806befcdd2dead8231a
SHA1

56eba5da31c728dc287435a555e527b1a27cae37
SHA256

9c798b5cf50fd400ce59355b91a741ab5ccfcffdaedc50815981fa280f4776a9
SHA512

f46f9b568f3d0cb6b4e799a68a3d7defd4e35cbf3df59840d05e575e8580a0cd8e95a497b5f5b272c21fe4105264272d4b58c8bec211597bbcf2de099eab49f3
SSDEEP

1536:N4eK+IFjWfoPbuaTRM3nFkwHbaA3LL0idWwiQcmWkF7jV:G+IF6foPCaTRMXbaev0FQcmWkRV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	f6b79788476c3806befcdd2dead8231a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	audiohd.exe

Executes dropped EXE 1 IoCs

pid	Process
5468	audiohd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f6b79788476c3806befcdd2dead8231a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	audiohd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4484	f6b79788476c3806befcdd2dead8231a.exe
5468	audiohd.exe
4852	powershell.exe
4852	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	f6b79788476c3806befcdd2dead8231a.exe
Token: SeDebugPrivilege	5468	audiohd.exe
Token: SeDebugPrivilege	4852	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 5468	4484	f6b79788476c3806befcdd2dead8231a.exe	88
PID 4484 wrote to memory of 5468	4484	f6b79788476c3806befcdd2dead8231a.exe	88
PID 4484 wrote to memory of 5468	4484	f6b79788476c3806befcdd2dead8231a.exe	88
PID 5468 wrote to memory of 4852	5468	audiohd.exe	91
PID 5468 wrote to memory of 4852	5468	audiohd.exe	91
PID 5468 wrote to memory of 4852	5468	audiohd.exe	91
PID 4852 wrote to memory of 5800	4852	powershell.exe	95
PID 4852 wrote to memory of 5800	4852	powershell.exe	95
PID 4852 wrote to memory of 5800	4852	powershell.exe	95
PID 5800 wrote to memory of 1188	5800	csc.exe	96
PID 5800 wrote to memory of 1188	5800	csc.exe	96
PID 5800 wrote to memory of 1188	5800	csc.exe	96

C:\Users\Admin\AppData\Local\Temp\f6b79788476c3806befcdd2dead8231a.exe
"C:\Users\Admin\AppData\Local\Temp\f6b79788476c3806befcdd2dead8231a.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe
  "C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -Path "C:\Users\Admin\AppData\Local\Microsoft\local.cs"; [LocalServ]::Listen()
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sifm4ged\sifm4ged.cmdline"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5800
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA364.tmp" "c:\Users\Admin\AppData\Local\Temp\sifm4ged\CSC66ABBC2B611A426FAAEA53C17E79AF2.TMP"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\audiohd.exe

Filesize
509KB

MD5
c29c8b1cc4dd0a7af073d2d6afd6b25f

SHA1
914037d3a16fb7a2f7aa5b7a2dc40522f7610a72

SHA256
a8308e01337c9219fe0266a2052c774a4e88f9a96b4cc4775b782dd50eef66ea

SHA512
4d29996387c0fa22a3b46ca06f2eecd61ea833d6689887ee3ee6d532a7ff1003b15f49991325cc3c447a9b6f4c2453888c52ccd3c81cda273d3e01cbbf765ca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\local.cs

Filesize
4KB

MD5
ff169c4274b91df68a1a0548b9186b29

SHA1
e2a406a1a49c5825d4f4279e82d1ca369433b244

SHA256
6da3e26b268e4a6c21e192c8b9a1b89aef6880bad673b79e6a889d29641ac2cc

SHA512
8785d91046722c0e8278fb95404ae284c3cf5e96060d06a7dc2209866b96618978e41844759da30fec7bdcef677fada61d3db498adbe989eaa87fbf84fc3366b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA364.tmp

Filesize
1KB

MD5
9571467c6de9c3b4a96d08628695bc56

SHA1
e128b3931f2a2ed3d91583cf0dcbf8f23cae13eb

SHA256
ca2c1630edf1e2068b9ae63a9d9eae738e2b945b604f7c7ee62884199680b4df

SHA512
2bd6e0d06b2561c3f51e8e17453cd63de1716c12f61b5517fb0e6d1ce82b4dd438929b3e1e0ba7ba6f1f733fca81377df1eb29e0210ccbb04fedf4c3916bc2af

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3gw5pzd0.bs0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\sifm4ged\sifm4ged.dll

Filesize
6KB

MD5
3f4e8adbcd68538cd485439713701b28

SHA1
4b116f352672ec6d355e374de80e02e643085760

SHA256
3da98af52a2f23be013cb635cc1a75987ead21f5a655399470806ee55d0a93fe

SHA512
2220a173a2b0afea530910e5872cb46347faeb1586d43d9807003f049970fdc3a25ca94740147d2fbd108a53cd21ba1a739731d9f92eff7ec67092ff15222d9f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sifm4ged\CSC66ABBC2B611A426FAAEA53C17E79AF2.TMP

Filesize
652B

MD5
d82455b8548c6e89c26c421b340d1b82

SHA1
55267c6334b010b5cc87987a6e552298a394d8fc

SHA256
bb9cc6a8ad80da4f390c9b5d5200c2a4929f9c9d46339a028b75002e2b046a83

SHA512
3cf8a087f62040cfcfaac2ccd490b4d5e255260f0df8b1a8108a259dd6facba08fff2f3737ae13ee269108fd7cbcfed62a705d1cbaa4e01c36aca9619293cb1d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sifm4ged\sifm4ged.cmdline

Filesize
360B

MD5
725b88afe4625245774c3f5f16dc5557

SHA1
8f89a162e12c98c794f44928aeaedd2a540c8f09

SHA256
7a72b3917eb47d06b13acfda8c54a80b929608831216534e6e4565d817a56ef6

SHA512
07240bbec78ef4cc13e20be78bcece77c94234bdf2026f142afa566af31600f3d908be88fc9b6286a83d296f492afdf2199fe043d899e749442525a670e692a6

Download Submit
memory/4484-1-0x0000000000E80000-0x0000000000E96000-memory.dmp

Filesize
88KB

Download
memory/4484-2-0x0000000005D80000-0x0000000006324000-memory.dmp

Filesize
5.6MB

Download
memory/4484-3-0x00000000058B0000-0x000000000594C000-memory.dmp

Filesize
624KB

Download
memory/4484-0-0x000000007485E000-0x000000007485F000-memory.dmp

Filesize
4KB

Download
memory/4852-36-0x00000000057C0000-0x0000000005B14000-memory.dmp

Filesize
3.3MB

Download
memory/4852-21-0x0000000004EE0000-0x0000000005508000-memory.dmp

Filesize
6.2MB

Download
memory/4852-23-0x0000000005640000-0x0000000005662000-memory.dmp

Filesize
136KB

Download
memory/4852-24-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/4852-26-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/4852-22-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/4852-38-0x0000000005E00000-0x0000000005E4C000-memory.dmp

Filesize
304KB

Download
memory/4852-37-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

Filesize
120KB

Download
memory/4852-39-0x0000000007600000-0x0000000007C7A000-memory.dmp

Filesize
6.5MB

Download
memory/4852-40-0x00000000062D0000-0x00000000062EA000-memory.dmp

Filesize
104KB

Download
memory/4852-20-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/4852-25-0x0000000005750000-0x00000000057B6000-memory.dmp

Filesize
408KB

Download
memory/4852-19-0x0000000004850000-0x0000000004886000-memory.dmp

Filesize
216KB

Download
memory/4852-52-0x0000000006360000-0x0000000006368000-memory.dmp

Filesize
32KB

Download
memory/4852-58-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/5468-16-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/5468-54-0x0000000006990000-0x0000000006A22000-memory.dmp

Filesize
584KB

Download
memory/5468-55-0x0000000006970000-0x000000000697A000-memory.dmp

Filesize
40KB

Download
memory/5468-56-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/5468-57-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download
memory/5468-17-0x0000000074850000-0x0000000075000000-memory.dmp

Filesize
7.7MB

Download