bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626.exe
Size

196KB
MD5

1a605e3307904488d47a2bcf26f3fe03
SHA1

2f659e8e8bea606bf48f8168d0da6ef5f5bb9141
SHA256

bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626
SHA512

b513db53f0cc579adb9e93a6cf1fb63987c7c7520603cf252740569b0c4c1ae09cded45f79e4e635cc42fb6e92a15992d7b39a11fce1975c399c9769ae6d5640
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCO2:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXH

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2248	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1984	zskhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\zskhost.exe	bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626.exe
File opened for modification	C:\Windows\Debug\zskhost.exe	bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zskhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	zskhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3044	bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2248	3044	bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626.exe	29
PID 3044 wrote to memory of 2248	3044	bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626.exe	29
PID 3044 wrote to memory of 2248	3044	bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626.exe	29
PID 3044 wrote to memory of 2248	3044	bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626.exe	29

C:\Users\Admin\AppData\Local\Temp\bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626.exe
"C:\Users\Admin\AppData\Local\Temp\bd2bcaec0cfb5a10999494b212f5be91b990154a97da6e94452e045fd3eae626.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BD2BCA~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2248

C:\Windows\Debug\zskhost.exe
C:\Windows\Debug\zskhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\zskhost.exe

Filesize
196KB

MD5
00296307a4852dc315e9e1bad194b367

SHA1
ce4f02a49bbfb6b18f05424c36b68ced262fced6

SHA256
f9a2b9e27c2710ecde52cd65de29c24ed7ceb4f99abe8ae20097cfb98f723875

SHA512
a14ec5b61d6ed8181b3530ceb6907b654d3094587625edd7be3bb9c3698ae0d7045c797df7fc520c1377ec0cc800032524452b2931abe511f94ba57ad42b4c32

Download Submit