Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 23:21
Static task
static1
Behavioral task
behavioral1
Sample
29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe
Resource
win10v2004-20220414-en
General
-
Target
29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe
-
Size
554KB
-
MD5
0fbcb5b55c5e2fb2b020d5cb7266ee69
-
SHA1
c4cf2886290641e7c00429c8d866de8eca642de5
-
SHA256
29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1
-
SHA512
b986e10ea0a67db49eab5d443de76ba64a1071c5f10e432b4d43c4619d4f63f8316582bc7d5238ef00526019af1d4218424b3b9613e5bf6fbc8f7316e2019654
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\imyviqaz = "\"C:\\Windows\\yqodyxhq.exe\"" explorer.exe -
Processes:
29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exedescription pid process target process PID 1552 set thread context of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1620 set thread context of 1272 1620 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\yqodyxhq.exe explorer.exe File created C:\Windows\yqodyxhq.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2032 vssadmin.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PhishingFilter explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exepid process 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 760 vssvc.exe Token: SeRestorePrivilege 760 vssvc.exe Token: SeAuditPrivilege 760 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exeexplorer.exedescription pid process target process PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1552 wrote to memory of 1620 1552 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe PID 1620 wrote to memory of 1272 1620 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe explorer.exe PID 1620 wrote to memory of 1272 1620 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe explorer.exe PID 1620 wrote to memory of 1272 1620 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe explorer.exe PID 1620 wrote to memory of 1272 1620 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe explorer.exe PID 1620 wrote to memory of 1272 1620 29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe explorer.exe PID 1272 wrote to memory of 2032 1272 explorer.exe vssadmin.exe PID 1272 wrote to memory of 2032 1272 explorer.exe vssadmin.exe PID 1272 wrote to memory of 2032 1272 explorer.exe vssadmin.exe PID 1272 wrote to memory of 2032 1272 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe"C:\Users\Admin\AppData\Local\Temp\29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe"C:\Users\Admin\AppData\Local\Temp\29846c5b0359085d68e8dd6c395228e5f17e950619a745b72f2a6835964f4db1.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ywynugoxasijikec\01000000Filesize
554KB
MD5d9e4a9ed562cac8174fa1187bed1db0f
SHA1c49c9c03354a7468fe290b2fe71f4ffd76557e5d
SHA256b7a9ec87ab607f0c46a866c1ffd418cdd6cc103a29e62f624dd56e58cbaf7989
SHA5122d8141b5de70147abb5104727ecb29947b039ea6e28ee9d5e46ea75e73bb4a43ad21e2767041be3fafbef7a5b3f24a120da2f110de833b386e2ce9347505fdcf
-
memory/1272-69-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/1272-80-0x0000000072AB1000-0x0000000072AB3000-memory.dmpFilesize
8KB
-
memory/1272-78-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/1272-75-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1272-73-0x000000000009A160-mapping.dmp
-
memory/1272-71-0x0000000000080000-0x00000000000BC000-memory.dmpFilesize
240KB
-
memory/1552-54-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/1620-55-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1620-68-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1620-66-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1620-65-0x000000000040A61E-mapping.dmp
-
memory/1620-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1620-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1620-77-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1620-58-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1620-61-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1620-60-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/2032-79-0x0000000000000000-mapping.dmp