c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e

Analysis

max time kernel
141s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e.exe
Size

193KB
MD5

95cfe667195d1c089cfcfeff824817df
SHA1

585f6bef55282f5434f9ed8f9b33cae4ab2036cd
SHA256

c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e
SHA512

ca8e5e8681720a0646b25c159b779062b8c25ca38102e2423dd94dd04f3f960d441a380f8e21ab8784155e45c976cce47e7c11fd7fd955bdf7a9c4b2bd69a38f
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO0:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXX5

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2640	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2908	ayahost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ayahost.exe	c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ayahost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ayahost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2932	c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2640	2932	c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e.exe	29
PID 2932 wrote to memory of 2640	2932	c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e.exe	29
PID 2932 wrote to memory of 2640	2932	c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e.exe	29
PID 2932 wrote to memory of 2640	2932	c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e.exe	29

C:\Users\Admin\AppData\Local\Temp\c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e.exe
"C:\Users\Admin\AppData\Local\Temp\c49a2b99a958f079b26c93069f4d6be0c305f6589bbd2e736dac49e00799a03e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C49A2B~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2640

C:\Windows\Debug\ayahost.exe
C:\Windows\Debug\ayahost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\ayahost.exe

Filesize
193KB

MD5
e66998e01f6f334b887e7d2279fcef4d

SHA1
f53fb58a27f11d51dea460161a23c99f0e27a944

SHA256
c0e448c1eddc14c460a7bb04e4be78928aa8182efbfa7a524c5c191cff14ef94

SHA512
1374b1f390774dd69361d123416a6909a7e4af6da809321324ad0fa44efc7dd27705ee45ded77d5b9f14a6cededcd3d512f2d46a7f1398096e90709636fb7525

Download Submit