40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 09:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe
Size

196KB
MD5

d9d4084af9aee0904c32bc85d0d0d599
SHA1

44cb44e5373603e2d7d48875d04522ae725e2d8c
SHA256

40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2
SHA512

8c627011f242d72ad65b77bde8dfe5053494b68f1a9406bd3ce973d87c5a499479409185ae9fa632a7b03eeba30d003bc228c6d3e3badcf7d59ec37eedd1a75f
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO6:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2328	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
3056	ayahost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ayahost.exe	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3048	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2328	3048	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe	29
PID 3048 wrote to memory of 2328	3048	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe	29
PID 3048 wrote to memory of 2328	3048	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe	29
PID 3048 wrote to memory of 2328	3048	40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe	29

C:\Users\Admin\AppData\Local\Temp\40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe
"C:\Users\Admin\AppData\Local\Temp\40d740fb98fae18d876403e894030be3d1f82cf9f074f5f071bb3d5cf0af16e2.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\40D740~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2328

C:\Windows\Debug\ayahost.exe
C:\Windows\Debug\ayahost.exe
1⤵
- Executes dropped EXE
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\ayahost.exe

Filesize
196KB

MD5
0874f96482e75dfb1c30bc5684a7da66

SHA1
962c08c18a59f6ed048b89dd83c2943a46f713a3

SHA256
6e283bc15cbbe6df1c4eeace92dc69e26b739350494642e555c2f37b77f59413

SHA512
ae1f351a696d4b549e64bbff3235e5d746b00724851b286a3f0fc3fa5d759dbb97e1b80c71ec8b0f0a6d120fbf999e12b6f841fcf67224cc796708181b1ac440

Download Submit