91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2023, 18:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56.exe
Size

198KB
MD5

d2b8e7f36debde19ed7911bec43a7340
SHA1

a635c7856ef693192c6dcd5d00bd89af64793551
SHA256

91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56
SHA512

1f811dc2781e4149e0a170501020cf6cdaf463f1792d99e51218540cc6b3d54d49870aad2c99f7aae3a7f5f76d312ceb1d9f3a8f015528e8788cad0575d26cbe
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO5:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXc

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56.exe

Executes dropped EXE 1 IoCs

pid	Process
4704	zewhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zewhost.exe	91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56.exe
File opened for modification	C:\Windows\Debug\zewhost.exe	91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zewhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	zewhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3584	91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4384	3584	91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56.exe	86
PID 3584 wrote to memory of 4384	3584	91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56.exe	86
PID 3584 wrote to memory of 4384	3584	91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56.exe	86

C:\Users\Admin\AppData\Local\Temp\91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56.exe
"C:\Users\Admin\AppData\Local\Temp\91a4797352bddbf7238c52f577990e0b13429387d513ba7addf31dcd6a15fe56.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\91A479~1.EXE > nul
  2⤵
  PID:4384

C:\Windows\Debug\zewhost.exe
C:\Windows\Debug\zewhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\zewhost.exe

Filesize
198KB

MD5
109e4279282e80433debf4f2a9accccb

SHA1
a8b2b7e2ba7c9472041a77e7c1f81dbb2b48da5b

SHA256
42604a9cb9357a9c36a2a8de8612a5dfa5ceb8e2ba668e01247289865f71d66f

SHA512
8fa21ceb899a3b1d3454d95f89fa6821aa37086e756df5ddf2493ca82d98e7e2bbb1412d872fd6069a12b01b8215c8ee97f575f027088701d3be682deca09bdc

Download Submit
C:\Windows\debug\zewhost.exe

Filesize
198KB

MD5
109e4279282e80433debf4f2a9accccb

SHA1
a8b2b7e2ba7c9472041a77e7c1f81dbb2b48da5b

SHA256
42604a9cb9357a9c36a2a8de8612a5dfa5ceb8e2ba668e01247289865f71d66f

SHA512
8fa21ceb899a3b1d3454d95f89fa6821aa37086e756df5ddf2493ca82d98e7e2bbb1412d872fd6069a12b01b8215c8ee97f575f027088701d3be682deca09bdc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads