c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c

Analysis

max time kernel
143s
max time network
146s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe
Size

199KB
MD5

92dbbb8753a4faec9db1f8aab7abaf3a
SHA1

3d3502c6c9b3a8c597337b6adfe596be0ca87b32
SHA256

c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c
SHA512

eaf5113de9de235cbf0b9c98422cf16de90fea4b7c608ac0d1670b4142ca0eb8f26794917643623f9ff56e09bbfa867619e2399cd81c73d35e149ccee29de696
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOM:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXt

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2724	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3064	ayahost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ayahost.exe	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ayahost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ayahost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3052	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2724	3052	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe	29
PID 3052 wrote to memory of 2724	3052	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe	29
PID 3052 wrote to memory of 2724	3052	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe	29
PID 3052 wrote to memory of 2724	3052	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe	29

C:\Users\Admin\AppData\Local\Temp\c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe
"C:\Users\Admin\AppData\Local\Temp\c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C325BE~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2724

C:\Windows\Debug\ayahost.exe
C:\Windows\Debug\ayahost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\ayahost.exe

Filesize
199KB

MD5
b87689cab63b04b72196d80a6b24f8e6

SHA1
0df750bd797c8297725f20ff1d8373e8fb23f846

SHA256
05e4640448b6bbdb83334bd44adb86af61ae6700aa4618b8998a65a5e361f4ca

SHA512
cc88c460b9f56d0dacc535808e7081eed7252c937b3d57cfd9d923c0883d460b65e7f12295f0e6d2459a2d11b1179628534dc734a09fc66599b61f2489497642

Download Submit