5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63

Analysis

max time kernel
140s
max time network
126s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63.exe
Size

197KB
MD5

c8de05fc72e94793747529babf4c5e7b
SHA1

212d2662433a133eebd2307c0d2c4170637968ed
SHA256

5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63
SHA512

008a2cd34bf0bb96600babaca3a99b4234e869239e66b4fa800ff93bfc787d414ae40942e3cf830977a7ae1afa41cbf45fdc0a3b8a3dcb65cffbf64d2a5e3a62
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOx:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXk

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2712	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2512	iuyhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\iuyhost.exe	5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iuyhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iuyhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1960	5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2712	1960	5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63.exe	29
PID 1960 wrote to memory of 2712	1960	5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63.exe	29
PID 1960 wrote to memory of 2712	1960	5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63.exe	29
PID 1960 wrote to memory of 2712	1960	5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63.exe	29

C:\Users\Admin\AppData\Local\Temp\5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63.exe
"C:\Users\Admin\AppData\Local\Temp\5ad3689b3da5fef0892030bd1b5fceafe617625c7a543d202e99e986cfdd4e63.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5AD368~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2712

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\iuyhost.exe

Filesize
197KB

MD5
00bdb6ee40c2501adbde13d2a813386d

SHA1
301a343025adb7868596969fcaf9b04be80e8c81

SHA256
31a7fea37ef12cc7d76e3a32c53cae6b57befad238767f4f52fb0082f80c6679

SHA512
dfc6fd00f1e405ab9ceed63eb18fbac62b6fac91d857056eeb38fcc8880fbe8ca6701b4311666f1e9ed68dda66bb22cb3256f00215f63d92ade6fa82b0e1d695

Download Submit