b14dc65ddee82651f45abcf6092da6318e936b071aa93fc955a3f930aea15beb

Analysis

max time kernel
228s
max time network
250s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 01:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a818d6834e4d351d6fa8a2348b73f4ee_JC.exe
Size

60KB
MD5

a818d6834e4d351d6fa8a2348b73f4ee
SHA1

b66018d1f8829b256473a6c07eabe6fbbadcd034
SHA256

b14dc65ddee82651f45abcf6092da6318e936b071aa93fc955a3f930aea15beb
SHA512

7e937a09aeaa440ba24e72bc54a52122ed3990b12758bc3d5afe47fa1983ac71f257ed96764bb4735031f0eaf9daaa15832e3fd649d1f97b56457db1369aacac
SSDEEP

384:+5rDuuOFpEauMLfQDb2pproT/z4o1GJE6Al6zVyXeTLhrqNNNNLwwwwgn777l:MDcpEBMLfQcubtGE96ByXeTLdb

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1856	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
3812	gyehost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\gyehost.exe	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe
File opened for modification	C:\Windows\Debug\gyehost.exe	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe
File opened for modification	C:\Windows\Debug\gyehost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2912	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 1856	2912	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	88
PID 2912 wrote to memory of 1856	2912	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	88
PID 2912 wrote to memory of 1856	2912	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	88
PID 2912 wrote to memory of 3668	2912	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	91
PID 2912 wrote to memory of 3668	2912	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	91
PID 2912 wrote to memory of 3668	2912	a818d6834e4d351d6fa8a2348b73f4ee_JC.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1856	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a818d6834e4d351d6fa8a2348b73f4ee_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a818d6834e4d351d6fa8a2348b73f4ee_JC.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\gyehost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:1856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A818D6~1.EXE > nul
  2⤵
  PID:3668

C:\Windows\Debug\gyehost.exe
C:\Windows\Debug\gyehost.exe
1⤵
- Executes dropped EXE
PID:3812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\gyehost.exe

Filesize
60KB

MD5
89d7569768ef37448aa2afae8af53287

SHA1
18efe3ec797ce58b72092deceb000dc2f9311769

SHA256
80ec66b5aa8c4ca59beeaf7d2ba0ec625285df86be5029c2a9ebfebcdd2355cf

SHA512
c9768e03710dca56556f868c19d1a9c43c694923efb15333ed6db240ec3f199e532f9d55d1f01ac5bc8818c5d695361d25d609c212800a721c1c718ceb162abc

Download Submit
C:\Windows\debug\gyehost.exe

Filesize
60KB

MD5
89d7569768ef37448aa2afae8af53287

SHA1
18efe3ec797ce58b72092deceb000dc2f9311769

SHA256
80ec66b5aa8c4ca59beeaf7d2ba0ec625285df86be5029c2a9ebfebcdd2355cf

SHA512
c9768e03710dca56556f868c19d1a9c43c694923efb15333ed6db240ec3f199e532f9d55d1f01ac5bc8818c5d695361d25d609c212800a721c1c718ceb162abc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads