06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d

Analysis

max time kernel
141s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d.exe
Size

196KB
MD5

b6320aa4e369a22f4571a976171f627a
SHA1

ce8a65d712e6b49f57040ed308efcd914811995e
SHA256

06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d
SHA512

55319a87d3c279e4ba68aa988018582790e328d22feba567ba7a67223849e435df72d00b3064076814020727fc336d99cb5cd5d6fd947349ab35d8b88d82ba7f
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOP:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXK

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2828	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1748	zskhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\zskhost.exe	06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d.exe
File created	C:\Windows\Debug\zskhost.exe	06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zskhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	zskhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2220	06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2828	2220	06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d.exe	29
PID 2220 wrote to memory of 2828	2220	06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d.exe	29
PID 2220 wrote to memory of 2828	2220	06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d.exe	29
PID 2220 wrote to memory of 2828	2220	06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d.exe	29

C:\Users\Admin\AppData\Local\Temp\06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d.exe
"C:\Users\Admin\AppData\Local\Temp\06ddeb04e4fef4e2b29ea0b40ec321331bd386ace4168904f6f7a06af24f4c2d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\06DDEB~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2828

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\zskhost.exe

Filesize
196KB

MD5
263a8b4dee4ae598e269f08c49b94836

SHA1
08a6f9b5094ad198a694916c42f22e6369fce186

SHA256
614b36991a1cab09f2addd7c7df9d534ecc698bfc932359194d8c44986c002bc

SHA512
145de7e9076bb1923d1cbb271f41f62f22ab65e278988629799572c3d2a15fa3924ffb9b0e1e1f69117f39a1c7935c0b230e67f7868bc2fcba0180a9a9d9f6d0

Download Submit