a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c

Analysis

max time kernel
140s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c.exe
Size

198KB
MD5

2ae1d7d0959366acb9caecc852a66aff
SHA1

4c9dbd750c764ebec60d2d3a4939aec391d34b8a
SHA256

a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c
SHA512

872142da9d9e0e4ae1619263caf5b829dd6823f8e604ad603d8840a09cb058925412e90bbb98f1c179067500c9b6ac0303d371864d6939604ed8aea94973dfc3
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOK:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXP

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2172	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1680	ayahost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\ayahost.exe	a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c.exe
File opened for modification	C:\Windows\Debug\ayahost.exe	a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ayahost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ayahost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2936	a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2172	2936	a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c.exe	29
PID 2936 wrote to memory of 2172	2936	a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c.exe	29
PID 2936 wrote to memory of 2172	2936	a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c.exe	29
PID 2936 wrote to memory of 2172	2936	a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c.exe	29

C:\Users\Admin\AppData\Local\Temp\a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c.exe
"C:\Users\Admin\AppData\Local\Temp\a6f9ddae3f745e0eb65e814b22757c5d2192a656d2434c18f1754df11896700c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A6F9DD~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2172

C:\Windows\Debug\ayahost.exe
C:\Windows\Debug\ayahost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\ayahost.exe

Filesize
198KB

MD5
ac01d761299f84b718869b5a6c384451

SHA1
7972aeb6abc5460fc737fc95208f24dcc8c234f4

SHA256
2c3810ba8fa0a8bf5534e4e4c8a479204748ce516fc6388c9110afa09de442d5

SHA512
19a56d6b500ed3a488936ee432993223eddad699a16c61dd03e1927475cefe984b213ef4ce75fcb954ae0657bea90af8de4ad0275e7b3d44bbe7f310c7da875c

Download Submit