cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf

Analysis

max time kernel
142s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf.exe
Size

198KB
MD5

74f1f357359853c0af29c9d32ed096c7
SHA1

12200f3db5034da44ba92ff9d81ac33dd5b0a929
SHA256

cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf
SHA512

3f59ba1c903dc72ac4cef178c36b0f01a0ffd0c959994c4575cec0001b6d1382af5e0a2e9ad7f832d56fcc0cf95b3e75a5bbdd714b3e296bb7587dca6e241936
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOG:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXj

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2776	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1452	iuyhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\iuyhost.exe	cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iuyhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iuyhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1496	cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2776	1496	cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf.exe	29
PID 1496 wrote to memory of 2776	1496	cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf.exe	29
PID 1496 wrote to memory of 2776	1496	cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf.exe	29
PID 1496 wrote to memory of 2776	1496	cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf.exe	29

C:\Users\Admin\AppData\Local\Temp\cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf.exe
"C:\Users\Admin\AppData\Local\Temp\cfb276dfb751419f360361f443f6d1144f99b1f0f46eec420ac71b01c2e099bf.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CFB276~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2776

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\iuyhost.exe

Filesize
198KB

MD5
3633531c5b3415ccb0d83a6e47acc234

SHA1
cfaa421fb3ad6107a759cea01d8fd8f8ba68c306

SHA256
f82de09d9d5226af47079a150773df1e57e03f6488f1278deed93c63ea823913

SHA512
ffd4f371108406f92fd9f9935ba04fcc537f2ea5493736eaf7954d50049855f150c52d0778bf36de5582e03fab2c68ce8ed27a152f6bd716c80d1b3b02106ac0

Download Submit
C:\Windows\debug\iuyhost.exe

Filesize
198KB

MD5
3633531c5b3415ccb0d83a6e47acc234

SHA1
cfaa421fb3ad6107a759cea01d8fd8f8ba68c306

SHA256
f82de09d9d5226af47079a150773df1e57e03f6488f1278deed93c63ea823913

SHA512
ffd4f371108406f92fd9f9935ba04fcc537f2ea5493736eaf7954d50049855f150c52d0778bf36de5582e03fab2c68ce8ed27a152f6bd716c80d1b3b02106ac0

Download Submit