ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48

Analysis

max time kernel
141s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 02:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe
Size 66KB
Sample240603-dektcsab46
SHA256 ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48
MD5 7595314afc725e66fbd379ba892587ef
SHA1 93f404edc427d16b6070d2b9aa05a494d4e5f94f
SHA512 5c3909bda3438bec4fb3952c5c14ea8e098396d584106374d3bd1464e6f18099cc9c30e874fb6449ca828ba5607f6e1491a2531df859653c1e8c9de1dc82c13b
SSDEEP 768:ZrItKyw5WHXfQIhIiIk9ecAaVPD96KyX6D:Zr3Z5IfQIR81ad5yX6D
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

resource	yara_rule
behavioral1/memory/2328-0-0x0000000000400000-0x0000000000411000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000c00000001231a-3.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2428-5-0x0000000000400000-0x0000000000411000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2328-6-0x0000000000400000-0x0000000000411000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/memory/2428-7-0x0000000000400000-0x0000000000411000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
500	attrib.exe

Deletes itself 1 IoCs

pid	Process
2064	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2428	iuyhost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\iuyhost.exe	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe
File opened for modification	C:\Windows\Debug\iuyhost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2328	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 500	2328	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe	28
PID 2328 wrote to memory of 500	2328	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe	28
PID 2328 wrote to memory of 500	2328	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe	28
PID 2328 wrote to memory of 500	2328	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe	28
PID 2328 wrote to memory of 2064	2328	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe	31
PID 2328 wrote to memory of 2064	2328	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe	31
PID 2328 wrote to memory of 2064	2328	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe	31
PID 2328 wrote to memory of 2064	2328	ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe	31

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
500	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe
"C:\Users\Admin\AppData\Local\Temp\ba7261acaa91eaef1afd3f53d95a6a49624c9b5f159d93deaca1ee13b750be48.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\iuyhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:500
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BA7261~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2064

C:\Windows\Debug\iuyhost.exe
C:\Windows\Debug\iuyhost.exe
1⤵
- Executes dropped EXE
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

iuyhost.exe

Path C:\Windows\Debug\iuyhost.exe
Size 66KB
SHA256 72c31283f2e9dfb674095900ed4b7e0b531666e9a07ca61c0b21568dce0c9186
MD5 7785f7060e04072f6a3ba34b1ebe22ab
SHA1 84432cc3b9af99e029efb2985b296fea361959c2
SHA512 86abe9896dc741d1dd30389c11ddf8bd5dd22b07399593c6d828f5eae7010712d65f10fd1de0170def3ee9ee21c8d23922807ef1378ef716536c52307192491c
SSDEEP 768:ZrItKyw5WHXfQIhIiIk9ecAaVPD96KyX62:Zr3Z5IfQIR81ad5yX62
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2328-0-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2328-6-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2428-5-0x0000000000400000-0x0000000000411000-memory.dmp

Download

memory/2428-7-0x0000000000400000-0x0000000000411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads