6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e

Analysis

max time kernel
141s
max time network
134s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15-10-2023 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe
Size

1.2MB
MD5

30bc3a5f2e0ce39f40fc7b7b8e8579ee
SHA1

0e7ce11e26c8fd9df95127e5d09022ebec85f71c
SHA256

6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e
SHA512

d1fc41e1ae92f49eb61cf89c0cb69cc8aeab2e5709d43101d2e8eb1148d522b295fb59fe98ce7952e503536763e6b7d20ac2c36d310d6665be79e4f009fdb799
SSDEEP

24576:GHXXX/XXXFqIIIcXXX5j2XXXcXXXfXXXxXXXLIII+Ph2kkkkK4kXkkkkkkkkhLXp:G9qIIIUjfIIIAbazR0vKLXZs

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2788	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1128	zskhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zskhost.exe	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zskhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	zskhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2700	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2788	2700	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe	29
PID 2700 wrote to memory of 2788	2700	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe	29
PID 2700 wrote to memory of 2788	2700	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe	29
PID 2700 wrote to memory of 2788	2700	6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe	29

C:\Users\Admin\AppData\Local\Temp\6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe
"C:\Users\Admin\AppData\Local\Temp\6665de6bda2b47436e9367010a2d7059e79e300e5aa1bc2e99b3c18b26758d0e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6665DE~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2788

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\zskhost.exe

Filesize
1.2MB

MD5
c59f491ef9aab441f0f8feebfa7c1ed5

SHA1
c7e9b5dd62f1a960117eaafd5038dcead0726b3b

SHA256
8512700ed0ec2e92df175850c7daecbcf00792350ae77c1d14196bdb837cd5d8

SHA512
25249eecdd0c4e095a58e12bb172d20909d3729203f35c035e2aab8cc1bd3923702d2d73df8e366c57de943ce5748aae42baee326a60d46dffb2284f662f8cf2

Download Submit
C:\Windows\debug\zskhost.exe

Filesize
1.2MB

MD5
c59f491ef9aab441f0f8feebfa7c1ed5

SHA1
c7e9b5dd62f1a960117eaafd5038dcead0726b3b

SHA256
8512700ed0ec2e92df175850c7daecbcf00792350ae77c1d14196bdb837cd5d8

SHA512
25249eecdd0c4e095a58e12bb172d20909d3729203f35c035e2aab8cc1bd3923702d2d73df8e366c57de943ce5748aae42baee326a60d46dffb2284f662f8cf2

Download Submit