ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e

Analysis

max time kernel
142s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
30/09/2023, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e.exe
Size

198KB
MD5

62867b4b6bc75b50a8c1e14cbad84e66
SHA1

3041d7c0cfeca0c2f361dc314d32099129fcce8a
SHA256

ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e
SHA512

53c30dda2a0898c1841659c8323f8f5593e06a56c91d6b87406a30719ffaccc623a95da5eaa6548a2e4112e9c8a5e1d18bde804cda54a37dc2cdbe819ace8489
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO1:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXU

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2644	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3000	ayahost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ayahost.exe	ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ayahost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ayahost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2692	ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2644	2692	ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e.exe	29
PID 2692 wrote to memory of 2644	2692	ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e.exe	29
PID 2692 wrote to memory of 2644	2692	ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e.exe	29
PID 2692 wrote to memory of 2644	2692	ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e.exe	29

C:\Users\Admin\AppData\Local\Temp\ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e.exe
"C:\Users\Admin\AppData\Local\Temp\ea5fd8b6d17acfe00a85cf2ced9300c08cf7a6c6ce02beb29bade8011553761e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EA5FD8~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2644

C:\Windows\Debug\ayahost.exe
C:\Windows\Debug\ayahost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\ayahost.exe

Filesize
199KB

MD5
0229fb8a06d539926e86db16db5e47f2

SHA1
dec7d3e139992bb81075dbbdf69bbed6c28f9ca9

SHA256
5af09ae56b48b54ccde346b70c75017ff79f2e2b2fffb8f4f8172f679a7bb97b

SHA512
7f402f3522cc99c637de2d3bcb6f9d95b006dadd21278fdb1fbb94d07b1eb05fdaab36b9bed7fc8f4b637d0928932a606223b2d33255d320c6a1b101c3e2bf3f

Download Submit
C:\Windows\debug\ayahost.exe

Filesize
199KB

MD5
0229fb8a06d539926e86db16db5e47f2

SHA1
dec7d3e139992bb81075dbbdf69bbed6c28f9ca9

SHA256
5af09ae56b48b54ccde346b70c75017ff79f2e2b2fffb8f4f8172f679a7bb97b

SHA512
7f402f3522cc99c637de2d3bcb6f9d95b006dadd21278fdb1fbb94d07b1eb05fdaab36b9bed7fc8f4b637d0928932a606223b2d33255d320c6a1b101c3e2bf3f

Download Submit