0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560

Analysis

max time kernel
143s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe
Size

199KB
MD5

e9e683d7420031ab88b4b9f1841aef30
SHA1

f796a034a94f5c2e78dfb5445e2cd58ff8b11242
SHA256

0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560
SHA512

5e5fe9ef2234eecd5c5b8a6c814de0b5a2be4e404afcea242fe1412bf73f7fb5bdbc23fcdecab3c37a553f10387b54a3e20dab9f2da8d9f06dd3159be395f65d
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOP:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXK

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2620	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2836	ayahost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ayahost.exe	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ayahost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ayahost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1572	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2620	1572	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe	29
PID 1572 wrote to memory of 2620	1572	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe	29
PID 1572 wrote to memory of 2620	1572	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe	29
PID 1572 wrote to memory of 2620	1572	0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe	29

C:\Users\Admin\AppData\Local\Temp\0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe
"C:\Users\Admin\AppData\Local\Temp\0be71f571babe545eb7d5609b60b9cdb29001073375ebabdc492cab6dd8fd560.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\0BE71F~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2620

C:\Windows\Debug\ayahost.exe
C:\Windows\Debug\ayahost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\ayahost.exe

Filesize
199KB

MD5
223db4905677d28652ad669cf8fb74f8

SHA1
3352c4b8220d6329cb1f97d27c9a3d755dd5bb92

SHA256
598c255b1b98ae4f42b2a625c401efd6c3db77f60d51b12e4f20da834f67ac54

SHA512
a4a31253d82f6fe47e9bb6efc8cca5f2484a1f905ac861758b99dfbfecdb4d429e8bddc5ced4293371ae208d2f7485db5d46eadb19c32b697a0f79120dc6825c

Download Submit
C:\Windows\debug\ayahost.exe

Filesize
199KB

MD5
223db4905677d28652ad669cf8fb74f8

SHA1
3352c4b8220d6329cb1f97d27c9a3d755dd5bb92

SHA256
598c255b1b98ae4f42b2a625c401efd6c3db77f60d51b12e4f20da834f67ac54

SHA512
a4a31253d82f6fe47e9bb6efc8cca5f2484a1f905ac861758b99dfbfecdb4d429e8bddc5ced4293371ae208d2f7485db5d46eadb19c32b697a0f79120dc6825c

Download Submit