Analysis
-
max time kernel
141s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 21:07
Static task
static1
Behavioral task
behavioral1
Sample
6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe
Resource
win10v2004-20240226-en
General
-
Target
6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe
-
Size
198KB
-
MD5
2fe5f92cd346808e1f27b69def18bca6
-
SHA1
e86f7ebfbb2cf79f8373bd64b8e1efbe269456bc
-
SHA256
6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf
-
SHA512
4912e3e296dba239bcf54088f9d79875d6c9216f5e3f689fe2e0904459d5cd8dafccb544b1b499fb700b204626aaaf7f79d7c653d15f6089ef757af4e7f0c33c
-
SSDEEP
6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOW:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXX7
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2552 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2356 zskhost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\zskhost.exe 6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe File opened for modification C:\Windows\Debug\zskhost.exe 6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 zskhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz zskhost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1704 6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2552 1704 6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe 29 PID 1704 wrote to memory of 2552 1704 6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe 29 PID 1704 wrote to memory of 2552 1704 6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe 29 PID 1704 wrote to memory of 2552 1704 6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe"C:\Users\Admin\AppData\Local\Temp\6af2acfc2952e9bc4b40eb1f3bf2bf3dc6425f3971a2720cbd6bdc4b13c25bbf.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6AF2AC~1.EXE > nul2⤵
- Deletes itself
PID:2552
-
-
C:\Windows\Debug\zskhost.exeC:\Windows\Debug\zskhost.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
198KB
MD51a0916ef1ccbc46cb10811f89146e4b3
SHA100dae7945df559bf3698fc74abfa324f36d10cc9
SHA25612263b3b034afbf25ac6c716ac293ab3f52ba3ac594c0459180ea29355e56732
SHA512c4cf9f313b82ca7f5f8bd00711591e36e700b4cf204fe4bb297276d049253841a3c732de192529915177daa3c90210c8e1111c48e17318e0e94e7c5f745392ec