9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522

Analysis

max time kernel
144s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522.exe
Size

198KB
MD5

ac7068a51668542490a3716adb7d2c00
SHA1

1fa98ca1b7dc93e64031c2234e02af06fc16ccf0
SHA256

9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522
SHA512

33d681f3598e123f7d56edf28c8936cae1d66c9e70924805d277e39c4a4fb1e96b108bd4a6bd2ad295c4bebbb38d794b66556ab6816131eeb47f1dfce8f2eb9d
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO+:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXr

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2396	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2248	iuyhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\iuyhost.exe	9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iuyhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iuyhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2312	9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2396	2312	9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522.exe	29
PID 2312 wrote to memory of 2396	2312	9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522.exe	29
PID 2312 wrote to memory of 2396	2312	9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522.exe	29
PID 2312 wrote to memory of 2396	2312	9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522.exe	29

C:\Users\Admin\AppData\Local\Temp\9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522.exe
"C:\Users\Admin\AppData\Local\Temp\9b7f76bea61ea9cdfa45f374c360fe6c33c80f725e458c1b15ff036cbd9fb522.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9B7F76~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2396

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\iuyhost.exe

Filesize
198KB

MD5
b0bbd0cd6694969f0c15b68ea3c88a12

SHA1
40e4415a175bd9ad920caae066e144b96eb0873a

SHA256
74edd5bf38bab7f57aac8f8eea20c7d55a5cfc5eabbf39ceae933ef64cde804b

SHA512
13aa3e204aa9dc7b0b543d7886e58a318ab53f8218f17157a832922f2d4e9b2f8f1a502b50014d057c0c7fc6b41f259657a30c5526092520185e0d3dd202179e

Download Submit