Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 15:43
Behavioral task
behavioral1
Sample
7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe
Resource
win10v2004-20241007-en
General
-
Target
7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe
-
Size
89KB
-
MD5
f6b20596a0c7d2c961542871e9ef2300
-
SHA1
66d60ac28547334ef7998744f27f6fa8341bed0e
-
SHA256
7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18
-
SHA512
a70529670e4a018530e3d62c8954d547940d80306db77cd6a5c79e13c61f4a794a7f5e5b3d2b4f9ecff5b1faefa3cfa196e790e7143460894ff2bb52b0d519df
-
SSDEEP
1536:yr3Z5IfQmv81a7pP1xF3yX2tM/jTEwwwEiiiixMkMMMMa:WJOfQm01q9X3yX2q/jTJJ
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1900 attrib.exe -
Deletes itself 1 IoCs
pid Process 2552 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2580 ayahost.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
resource yara_rule behavioral1/memory/1640-0-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/files/0x0007000000012116-4.dat upx behavioral1/memory/2580-5-0x0000000000400000-0x0000000000416000-memory.dmp upx behavioral1/memory/2580-6-0x0000000000400000-0x0000000000416000-memory.dmp upx -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Debug\ayahost.exe 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe File opened for modification C:\Windows\Debug\ayahost.exe 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe File opened for modification C:\Windows\Debug\ayahost.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ayahost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ayahost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ayahost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1640 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1900 1640 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe 30 PID 1640 wrote to memory of 1900 1640 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe 30 PID 1640 wrote to memory of 1900 1640 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe 30 PID 1640 wrote to memory of 1900 1640 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe 30 PID 1640 wrote to memory of 2552 1640 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe 33 PID 1640 wrote to memory of 2552 1640 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe 33 PID 1640 wrote to memory of 2552 1640 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe 33 PID 1640 wrote to memory of 2552 1640 7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe 33 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 1900 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe"C:\Users\Admin\AppData\Local\Temp\7f5a2a16b8ea48b6b87919c6282bdc68583cf2ae8cd3c0b7b0a57f5cd2547e18N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\attrib.exeattrib +a +s +h +r C:\Windows\Debug\ayahost.exe2⤵
- Sets file to hidden
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1900
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7F5A2A~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2552
-
-
C:\Windows\Debug\ayahost.exeC:\Windows\Debug\ayahost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2580
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD58e1fc2132feedc791cbc5e8df83de327
SHA168f48b3fe2d0712a49db89647639fe545875b6ca
SHA256a26f913d070d77eac487f12967e35f0573e6341248577b851dbfbb3afb22e13c
SHA5127983d9d79e7dcab07d178bcd1aab01d37a35797425fe3a30e8d0d4cb9c263358883cac308a0c035cfc858ef5fed429ec5630d2601057163861fc2673bf27248d