a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c

General

Target

a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe
Size

79KB
MD5

1db365027f492b5e0712486b37b02900
SHA1

9a8199d05cbf3456d42da2d4559a64c7bbd453e8
SHA256

a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c
SHA512

50a53cef46421a632a2793aae20979e5f9efb6d6d8679148bf04d2cad4d8e2e15b67ad55dc58abad93dad9e26ce4111cd35683b8217af1581017aff951b6e495
SSDEEP

1536:bDcWLfIbgEp10gyX/dtnTHNWnnn622222L:bDXL0n0gyX/d1re2222L

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3028 attrib.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2588 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

iuyhost.exe

pid process

2644 iuyhost.exe

pid	process
3028	attrib.exe

pid	process
2588	cmd.exe

pid	process
2644	iuyhost.exe

Drops file in Windows directory 3 IoCs

Processes:

a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exeattrib.exe

description	ioc	process
File created	C:\Windows\Debug\iuyhost.exe	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

iuyhost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	iuyhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	iuyhost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe

description pid process

Token: SeIncBasePriorityPrivilege 1744 a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1744	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe

description	pid	process	target process
PID 1744 wrote to memory of 3028	1744	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe	attrib.exe
PID 1744 wrote to memory of 3028	1744	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe	attrib.exe
PID 1744 wrote to memory of 3028	1744	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe	attrib.exe
PID 1744 wrote to memory of 3028	1744	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe	attrib.exe
PID 1744 wrote to memory of 2588	1744	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe	cmd.exe
PID 1744 wrote to memory of 2588	1744	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe	cmd.exe
PID 1744 wrote to memory of 2588	1744	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe	cmd.exe
PID 1744 wrote to memory of 2588	1744	a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe	cmd.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3028 attrib.exe

pid	process
3028	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe
"C:\Users\Admin\AppData\Local\Temp\a6e22845950328743a6234101afd45404a4d3301818796ed33fab3a9ad6ebd6c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744

C:\Windows\SysWOW64\attrib.exe
attrib +a +s +h +r C:\Windows\Debug\iuyhost.exe
2⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:3028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A6E228~1.EXE > nul
2⤵
- Deletes itself
PID:2588

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\iuyhost.exe
Filesize
79KB

MD5
b426b65f055a4076a5bd7d89c29f6bd7

SHA1
9ecda682d5845fb8ec3d7d82b1bfbf64d1f85031

SHA256
2ccdbeb707c5f215161f3ed2c8a9991e669ed6f13f8532c028f0a2cd253a8fcb

SHA512
3f1844f0b4162c512b100769b426f5c02097a34b5a9464fb1bc46968e6a6e77f6d737148183887f2fa4b7843d436f446549f5c92569b62fb63bf8ae9152ca57a

Download Submit
memory/1744-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1744-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2644-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2644-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads