224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c

Analysis

max time kernel
141s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c.exe
Size

199KB
MD5

69f56d68843f5d902a9b3263d019633a
SHA1

aa5962c43b8c13ab69b706c364542b15ee4ccd99
SHA256

224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c
SHA512

55c2a1ba82b2757a83789a96d526ab2b8a4d304b9e2f3fb3636c871da0149efa5f1243ef3704b9f36898662185b86bae883f15dad8642cdf5bdb81ca0844e698
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOk:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXX1

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2316	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2240	iuyhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\iuyhost.exe	224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iuyhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iuyhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1764	224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2316	1764	224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c.exe	29
PID 1764 wrote to memory of 2316	1764	224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c.exe	29
PID 1764 wrote to memory of 2316	1764	224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c.exe	29
PID 1764 wrote to memory of 2316	1764	224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c.exe	29

C:\Users\Admin\AppData\Local\Temp\224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c.exe
"C:\Users\Admin\AppData\Local\Temp\224040ab310fe2e336c1e8f259d6ef5d051f4c88528a94cea113f9c0ed0e226c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\224040~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2316

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\iuyhost.exe

Filesize
199KB

MD5
1110733d482a86fefb0252cf2bc36e69

SHA1
d898cbb102c6e18a2b8d8e2fbf2ff5aacf679d0a

SHA256
57c9ae59e5924dbda147b5e7b63c228764610c2666e8d46c9acd01c71d80ce28

SHA512
7cd8220e59aaf724df45b0d27d9bf2ad845dbe453ba8625bf1f64d7f1a21edd83f41405c109be016f3d4198551eb4ff2036f05d830282f0f950d25168189cc7c

Download Submit
C:\Windows\debug\iuyhost.exe

Filesize
199KB

MD5
1110733d482a86fefb0252cf2bc36e69

SHA1
d898cbb102c6e18a2b8d8e2fbf2ff5aacf679d0a

SHA256
57c9ae59e5924dbda147b5e7b63c228764610c2666e8d46c9acd01c71d80ce28

SHA512
7cd8220e59aaf724df45b0d27d9bf2ad845dbe453ba8625bf1f64d7f1a21edd83f41405c109be016f3d4198551eb4ff2036f05d830282f0f950d25168189cc7c

Download Submit