5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
30/08/2023, 02:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe
Size

198KB
MD5

37e080c0637ecd7a0a4b5bdb34bff43b
SHA1

34f006f2eeece42cf1c0e18b4c35f3905c257240
SHA256

5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6
SHA512

ef1cfd96e4e5c0b72f0d9aea263c80b1d328ac97c77a0c054fe7777e238cf1926fd106535fb96e295a7409eebc849b7ba110d17a053fc1bb9823beda159b2aad
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOK:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXD

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2816	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2332	zskhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zskhost.exe	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2488	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2816	2488	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe	29
PID 2488 wrote to memory of 2816	2488	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe	29
PID 2488 wrote to memory of 2816	2488	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe	29
PID 2488 wrote to memory of 2816	2488	5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe	29

C:\Users\Admin\AppData\Local\Temp\5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe
"C:\Users\Admin\AppData\Local\Temp\5acf91adbd029b57e056375855e3bdea11a2f14c118624f72b6a1c0282bc53d6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5ACF91~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2816

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\zskhost.exe

Filesize
198KB

MD5
7668ec96d96d408edbb98dd51093120b

SHA1
ff69085d44f0bd192b333294e05bb973aaf2f63e

SHA256
aa4a53b48d9229a2a8eb2c7c2b3522b3f7e0a0861f20ceddf401a26d00d8757b

SHA512
0ab740effa8ff52247070fe6e1ee1942232423ab9e895e15a45e41dfc94590e31a0f0bd786fa9ecdc7874c939db7057839fec2cb40cc802fdd443392dd5cd664

Download Submit