53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96

Analysis

max time kernel
141s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 21:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe
Size

196KB
MD5

d43ae4ce9cdb22793d56ad7798a8eb66
SHA1

df5dd918c7f9b352ab2cc1a75e216f6f0bdba7da
SHA256

53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96
SHA512

636fe71b8f4146e8c545cc8ffe02aeec8d0047fb862be184e83654615823e4e11f572fbecf167b4d7b24531a7565879f7ba399dd1cdf0b2900782ac7d04d003a
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO3:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXq

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2088	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1292	iuyhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\iuyhost.exe	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iuyhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iuyhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1380	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 2088	1380	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe	29
PID 1380 wrote to memory of 2088	1380	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe	29
PID 1380 wrote to memory of 2088	1380	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe	29
PID 1380 wrote to memory of 2088	1380	53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe	29

C:\Users\Admin\AppData\Local\Temp\53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe
"C:\Users\Admin\AppData\Local\Temp\53ce817342e44184bc016b52add09c9fb9a2562643aed63fb227f8acaf982a96.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\53CE81~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2088

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\iuyhost.exe

Filesize
196KB

MD5
a54a1c3df21f6abbc6efce12ef292e80

SHA1
3e8cdf47b1dcc99af3265cfe1c862bf054df8b02

SHA256
6009c4b1721df0d26a9eaa0cd141d1b18d5e1b1913908de95feed3505c017b94

SHA512
08bbc6c806a1f639c1782618a271a2d764a64c04baf1b0d153c3c43ab271813931539b2cd7b487cdde94d1ec2b2da9179b089bfb1a74b27ea23b9e7ad085858f

Download Submit