06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb.exe
Size

196KB
MD5

760973daaf6a6eae91fdddbb2ff4f77c
SHA1

60ff2ac2447cd41c7c9f5cbe82aa00d111edcd51
SHA256

06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb
SHA512

c038fc5427ed01380fe80c85b691d6a8fea69cd873baa7f5fe739bffae5075e6e919a03ab91de4ec55d2b4847c3b5ac52a751c5d228be092e462c581d689c7ed
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOw:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXZ

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2404	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2108	ayahost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ayahost.exe	06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ayahost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ayahost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3016	06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2404	3016	06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb.exe	29
PID 3016 wrote to memory of 2404	3016	06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb.exe	29
PID 3016 wrote to memory of 2404	3016	06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb.exe	29
PID 3016 wrote to memory of 2404	3016	06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb.exe	29

C:\Users\Admin\AppData\Local\Temp\06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb.exe
"C:\Users\Admin\AppData\Local\Temp\06c511477acc39f0c1a7be8349c6364d43d83c2837c9b145c9e800e612c7cdeb.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\06C511~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2404

C:\Windows\Debug\ayahost.exe
C:\Windows\Debug\ayahost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\ayahost.exe

Filesize
196KB

MD5
7f22a9ef935cad36dbdc7f05ef48e03d

SHA1
790860ee0d08c447ec8003ea1b2675bd7ad5532a

SHA256
e9c80214c35d16836d68508c1e311ea1e6be8e66526edadfffaf9763f85369cd

SHA512
f22bae7f17091b880e19509211b79183a3201185adaf9045379082ee7e22c17caa630aacca078a56926176d569935775e703296f98333eccc306d7216d0658f3

Download Submit