3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da

Analysis

max time kernel
141s
max time network
130s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da.exe
Size

374KB
MD5

7217068d4d76ed11548d48430e3179a3
SHA1

63b5c46eb7f9f58b7d8a5aac0e03f9924fc31c69
SHA256

3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da
SHA512

eb9d8eecd18d30dd46a6adc0d13d5a674d153995e57182760ac390c731cc1ed1702af4301222f98112126328607d3ee728aa4de4218f4a5ab0c895abae9ed388
SSDEEP

6144:/Bs27GluLyXxQQIIIhg6XXXDzXXX13s2III/TAXXXmlXXXLIIIG/ru5Yg/18ddvt:/K2+yQIII1XXX/XXX62III/UXXXmlXXn

Score

9^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012262-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Deletes itself 1 IoCs

pid	Process
2592	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2888	iuyhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\iuyhost.exe	3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iuyhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iuyhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2988	3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2592	2988	3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da.exe	29
PID 2988 wrote to memory of 2592	2988	3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da.exe	29
PID 2988 wrote to memory of 2592	2988	3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da.exe	29
PID 2988 wrote to memory of 2592	2988	3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da.exe	29

C:\Users\Admin\AppData\Local\Temp\3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da.exe
"C:\Users\Admin\AppData\Local\Temp\3aedcc87c87a6aeef1de571bbbbbe24762bac5faa7fd6d65dc1d19072474c3da.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3AEDCC~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2592

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\iuyhost.exe

Filesize
374KB

MD5
8ec46789a79b5d6763f4f041bff5d416

SHA1
0f80bbec706cf494ad0022a98f2390c34ea3ff0b

SHA256
4b04fb1bc8228470b5d3c944505b7fe440e524b7b1642b6d90a8b15114d5b6e7

SHA512
944727d10ca4b2b18794189ee8b3fb3cebdb14b3b862165e9c6f239859da00a48ce1e2185c3d71d5ea77b383238c88a67097246d578a7f5a4a572b25b7c05c7e

Download Submit