ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2023, 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe
Size

194KB
MD5

c9a6535341c6a29f5ae5c1b640427dd4
SHA1

9c94624ebd1f6e9ea935525a531fb5cdc8597905
SHA256

ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797
SHA512

4e3b847b4a1001b7b6d92312105c3ee57aeb9edf85ec5a379ab08fa98a04cecd43e5157815c1f68b0e82fa2a4ccd6178ae9179b6436e2e9dc883745431691bae
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOE:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXt

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4364	oqchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\oqchost.exe	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe
File opened for modification	C:\Windows\Debug\oqchost.exe	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4360	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 892	4360	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe	82
PID 4360 wrote to memory of 892	4360	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe	82
PID 4360 wrote to memory of 892	4360	ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe	82

C:\Users\Admin\AppData\Local\Temp\ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe
"C:\Users\Admin\AppData\Local\Temp\ee02240b03868c543dd407fcc0cf8637b275f33274b554901c7872ce90ad5797.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EE0224~1.EXE > nul
  2⤵
  PID:892

C:\Windows\Debug\oqchost.exe
C:\Windows\Debug\oqchost.exe
1⤵
- Executes dropped EXE
PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\oqchost.exe

Filesize
194KB

MD5
85490e53647009a6410574a745719d73

SHA1
f5d28fb7456951b251845d38ed8152fe9cbf83f8

SHA256
2b805929d7683c3ffe8cef769a4b5b9e51428131bbf40d12141fb907020c5e34

SHA512
889bd222e9c97e1f26d38706c41eabe8152a581df27a85b227d84349659a1e607f48907bc70e0a644f647e16170e5ce4dbc1aa17fe181ca95c1606615cc83113

Download Submit
C:\Windows\debug\oqchost.exe

Filesize
194KB

MD5
85490e53647009a6410574a745719d73

SHA1
f5d28fb7456951b251845d38ed8152fe9cbf83f8

SHA256
2b805929d7683c3ffe8cef769a4b5b9e51428131bbf40d12141fb907020c5e34

SHA512
889bd222e9c97e1f26d38706c41eabe8152a581df27a85b227d84349659a1e607f48907bc70e0a644f647e16170e5ce4dbc1aa17fe181ca95c1606615cc83113

Download Submit