Analysis
-
max time kernel
149s -
max time network
53s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 09:31
Static task
static1
Behavioral task
behavioral1
Sample
YKBGunlukEkstre.exe
Resource
win7
Behavioral task
behavioral2
Sample
YKBGunlukEkstre.exe
Resource
win10v200430
General
-
Target
YKBGunlukEkstre.exe
-
Size
445KB
-
MD5
020a647bece9a854fab2e6e544de336b
-
SHA1
8d9b566018fec73fb4dc5ac9cfcb7bb505ebf67f
-
SHA256
d4c2c7795496056ece8e0de136ae63b316508f15bfa28582ceafbb190abfd790
-
SHA512
11e6cab89acf2730f24541d33ec01d1c4ded2960522d87e844427d38785a1fc7800569c4e174acae4e2fbd7880235ca6c42c20ca323c4607a17bbbf293ff76fb
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1088 cmd.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
YKBGunlukEkstre.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion YKBGunlukEkstre.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion YKBGunlukEkstre.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
YKBGunlukEkstre.exeExplorer.EXEcscript.exedescription pid process target process PID 1100 wrote to memory of 912 1100 YKBGunlukEkstre.exe YKBGunlukEkstre.exe PID 1100 wrote to memory of 912 1100 YKBGunlukEkstre.exe YKBGunlukEkstre.exe PID 1100 wrote to memory of 912 1100 YKBGunlukEkstre.exe YKBGunlukEkstre.exe PID 1100 wrote to memory of 912 1100 YKBGunlukEkstre.exe YKBGunlukEkstre.exe PID 1100 wrote to memory of 912 1100 YKBGunlukEkstre.exe YKBGunlukEkstre.exe PID 1100 wrote to memory of 912 1100 YKBGunlukEkstre.exe YKBGunlukEkstre.exe PID 1100 wrote to memory of 912 1100 YKBGunlukEkstre.exe YKBGunlukEkstre.exe PID 1264 wrote to memory of 308 1264 Explorer.EXE cscript.exe PID 1264 wrote to memory of 308 1264 Explorer.EXE cscript.exe PID 1264 wrote to memory of 308 1264 Explorer.EXE cscript.exe PID 1264 wrote to memory of 308 1264 Explorer.EXE cscript.exe PID 308 wrote to memory of 1088 308 cscript.exe cmd.exe PID 308 wrote to memory of 1088 308 cscript.exe cmd.exe PID 308 wrote to memory of 1088 308 cscript.exe cmd.exe PID 308 wrote to memory of 1088 308 cscript.exe cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
YKBGunlukEkstre.exeYKBGunlukEkstre.execscript.exedescription pid process target process PID 1100 set thread context of 912 1100 YKBGunlukEkstre.exe YKBGunlukEkstre.exe PID 912 set thread context of 1264 912 YKBGunlukEkstre.exe Explorer.EXE PID 308 set thread context of 1264 308 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
YKBGunlukEkstre.execscript.exepid process 912 YKBGunlukEkstre.exe 912 YKBGunlukEkstre.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe 308 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
YKBGunlukEkstre.execscript.exedescription pid process Token: SeDebugPrivilege 912 YKBGunlukEkstre.exe Token: SeDebugPrivilege 308 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
YKBGunlukEkstre.execscript.exepid process 912 YKBGunlukEkstre.exe 912 YKBGunlukEkstre.exe 912 YKBGunlukEkstre.exe 308 cscript.exe 308 cscript.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
YKBGunlukEkstre.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions YKBGunlukEkstre.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
YKBGunlukEkstre.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools YKBGunlukEkstre.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
YKBGunlukEkstre.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum YKBGunlukEkstre.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 YKBGunlukEkstre.exe -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\YKBGunlukEkstre.exe"C:\Users\Admin\AppData\Local\Temp\YKBGunlukEkstre.exe"2⤵
- Checks BIOS information in registry
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Maps connected drives based on registry
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\YKBGunlukEkstre.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:912 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:308 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\YKBGunlukEkstre.exe"3⤵
- Deletes itself
PID:1088