02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34

Analysis

max time kernel
141s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34.exe
Size

194KB
MD5

e82e1f6ba443b1be87a3e1f69a5c5548
SHA1

50953d7e896fdb8ed74cfdbebea01d4146e2d05c
SHA256

02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34
SHA512

f6c0a49d90b8ccd48328b4149b6ef6a705fb910f777ab850d0c4e2e5ce900b5e42eb0e1e89c0acc903eae172a7bcf9040194bcc14c0710356a79b410756d3a3c
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO6:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXr

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2472	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2276	zskhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zskhost.exe	02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zskhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	zskhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2660	02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2472	2660	02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34.exe	29
PID 2660 wrote to memory of 2472	2660	02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34.exe	29
PID 2660 wrote to memory of 2472	2660	02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34.exe	29
PID 2660 wrote to memory of 2472	2660	02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34.exe	29

C:\Users\Admin\AppData\Local\Temp\02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34.exe
"C:\Users\Admin\AppData\Local\Temp\02b40b84142a43c983a1ab053cc5a606bb3969fb336cd73e82ed6a890ffb9c34.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\02B40B~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2472

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\zskhost.exe

Filesize
194KB

MD5
1b3d4e81b91e48c838c1fe5a7e002329

SHA1
56de53ab3a6085c14e3ddcbfabf6aeada49661cd

SHA256
9473ac93ce5632cf9f154da563c35b27c06c7d3d5534dabbae0a4a32e88d2ec1

SHA512
33f9be0347064ca68d25ff906a8534b9d8224325b8a2b46dfc76f7e8626161199f99f438b907821ac0e27d013eeaa07e20b3b87afb77c0952feca718ec2c7b01

Download Submit