7dd9ef5b7c5ac6bc56e731558b8d02156ab3f6934f251a9cc57081a43ab85bab

Analysis

max time kernel
178s
max time network
169s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/01/2024, 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed3974bcf5026eb7a2caeb50dd745234.exe
Size

68KB
MD5

ed3974bcf5026eb7a2caeb50dd745234
SHA1

36b21fb27cf6f6f0dc29d61a5a4a413f9eae909c
SHA256

7dd9ef5b7c5ac6bc56e731558b8d02156ab3f6934f251a9cc57081a43ab85bab
SHA512

efc88f66844f740caf465990c515616ac0b9bd508b0b48eca2977a8bafc4d1fbfcd84a0e997018af29d268a5e940cdba828117cb68bffa7b1f8941761305ba1f
SSDEEP

768:TrItKyw5WHXfQmjIiIk9ecAa0Mb96SyX1DLdRXXXYH:Tr3Z5IfQmv81ar1yXtZS

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2744	attrib.exe

Deletes itself 1 IoCs

pid	Process
2580	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2552	zskhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zskhost.exe	ed3974bcf5026eb7a2caeb50dd745234.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	ed3974bcf5026eb7a2caeb50dd745234.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2288	ed3974bcf5026eb7a2caeb50dd745234.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2744	2288	ed3974bcf5026eb7a2caeb50dd745234.exe	15
PID 2288 wrote to memory of 2744	2288	ed3974bcf5026eb7a2caeb50dd745234.exe	15
PID 2288 wrote to memory of 2744	2288	ed3974bcf5026eb7a2caeb50dd745234.exe	15
PID 2288 wrote to memory of 2744	2288	ed3974bcf5026eb7a2caeb50dd745234.exe	15
PID 2288 wrote to memory of 2580	2288	ed3974bcf5026eb7a2caeb50dd745234.exe	31
PID 2288 wrote to memory of 2580	2288	ed3974bcf5026eb7a2caeb50dd745234.exe	31
PID 2288 wrote to memory of 2580	2288	ed3974bcf5026eb7a2caeb50dd745234.exe	31
PID 2288 wrote to memory of 2580	2288	ed3974bcf5026eb7a2caeb50dd745234.exe	31

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2744	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ed3974bcf5026eb7a2caeb50dd745234.exe
"C:\Users\Admin\AppData\Local\Temp\ed3974bcf5026eb7a2caeb50dd745234.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\zskhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2744
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\ED3974~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2580

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\zskhost.exe

Filesize
18KB

MD5
bcfdab1cbacbe3156f48cb6050bbd2f5

SHA1
255d3ead4ad167aaa26d33705498e553fd06c5b8

SHA256
91b11ab5eba16fcea18c7d5fd22871bb148f137582e52c289482cdd14cd7f01b

SHA512
5b556e37cda4a1d4cae3d5f00c42e8165deec61fe544edb2fada9e7f69ec8802ecfd01c739008cd52a4122696979f058f090ef54d1650d25e5edc86c88f97040

Download Submit
C:\Windows\debug\zskhost.exe

Filesize
68KB

MD5
2c3e0bb53ec4a1b2e9a85d11dc2fa960

SHA1
5e0b87fc4942c98ebc541ef278d82eef3692090f

SHA256
0c309db25b9db8aa1f84841ffd96e3b2537f9df4feb98f7d9951f27fbd9256af

SHA512
fc50ff3fa12102e9ef443b164b39c5e2dbb95e4b153074acef77e010cb576ea0bf36ac8dbe6959b994d6e49db7fc8264786dd6a3a8f7058cb58eae9ed86a15b8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads