b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17.exe
Size

196KB
MD5

3fb6ac2904cd31e1a3e57fe0d6db6cbe
SHA1

8f08f0de50b30d395e3ea7205f8744ddfcb34715
SHA256

b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17
SHA512

7171658197a1976cd601b5d337718e736285713cf1a773458446ed05817b18bc5c59af3beb68fc0c0384129a7b1970ee42f1b5e33270de63c04e8996a2104154
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO1:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXg

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2104	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1788	zskhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zskhost.exe	b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zskhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	zskhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2172	b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2104	2172	b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17.exe	29
PID 2172 wrote to memory of 2104	2172	b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17.exe	29
PID 2172 wrote to memory of 2104	2172	b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17.exe	29
PID 2172 wrote to memory of 2104	2172	b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17.exe	29

C:\Users\Admin\AppData\Local\Temp\b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17.exe
"C:\Users\Admin\AppData\Local\Temp\b8e48a8531a0de79f8902330ba65787579a6fb347ccb5dca879af6acae4a3e17.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B8E48A~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2104

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\zskhost.exe

Filesize
196KB

MD5
a227f2bc198aec5b73ea927dd0a5db97

SHA1
d8a6a1f4954d5248a6dbaff3cbdccf4f07267237

SHA256
458e3132c27dae394d4e915581aa45cc11cea8aebc3e226ac13927b722b76e5b

SHA512
3ce697f6a507344dc0ef4c509b816ad11cbb613ebf78c7d9a86e3953a83ee529449dcde6d3f6c8602916873e4a581557013d1ed32bb27b84fd048cb15007994e

Download Submit