ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19/08/2023, 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe
Size

194KB
MD5

c9a6535341c6a29f5ae5c1b640427dd4
SHA1

9c94624ebd1f6e9ea935525a531fb5cdc8597905
SHA256

ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797
SHA512

4e3b847b4a1001b7b6d92312105c3ee57aeb9edf85ec5a379ab08fa98a04cecd43e5157815c1f68b0e82fa2a4ccd6178ae9179b6436e2e9dc883745431691bae
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOE:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXt

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2864	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2216	ayahost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ayahost.exe	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2332	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2864	2332	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe	29
PID 2332 wrote to memory of 2864	2332	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe	29
PID 2332 wrote to memory of 2864	2332	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe	29
PID 2332 wrote to memory of 2864	2332	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe	29

C:\Users\Admin\AppData\Local\Temp\ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe
"C:\Users\Admin\AppData\Local\Temp\ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EE0224~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2864

C:\Windows\Debug\ayahost.exe
C:\Windows\Debug\ayahost.exe
1⤵
- Executes dropped EXE
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\ayahost.exe

Filesize
194KB

MD5
bb9e57e76e37df6a60f2b8a3d1e3775b

SHA1
280b0488aa9ce5b305cc28af60fb6250b2d28890

SHA256
92d07f0ecb7877cb81d40e11b3edffb47d9a6d3dd721b417ebd8d6363d5ac629

SHA512
decc43ac46e8581dc44856152062f88160073db5226beeb7dbd12e7a1cee3f26ea9a7bfedc16fd8fe20fd15bfd46d165729fed32f870a22c9caa89a39577fcf5

Download Submit