Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:30
Static task
static1
Behavioral task
behavioral1
Sample
ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe
Resource
win10v2004-20220414-en
General
-
Target
ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe
-
Size
554KB
-
MD5
eae7974d820bd517495222b9a616a5c5
-
SHA1
ed1344541be0cce3e93177ac577f56fa0b06b9f4
-
SHA256
ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9
-
SHA512
2cc45bdb0b359d65246b731f9b009de68c625fc667bcd5f19d8e5846a7b627af65cb78665f86d9913f398cf734fe00a65480612b4d3c083f6d661434f581c679
Malware Config
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\egalusiw = "\"C:\\Windows\\yhegakyw.exe\"" explorer.exe -
Processes:
ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exeae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exedescription pid process target process PID 1808 set thread context of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1632 set thread context of 1944 1632 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe explorer.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\yhegakyw.exe explorer.exe File created C:\Windows\yhegakyw.exe explorer.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 808 vssadmin.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PhishingFilter explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0" explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exepid process 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1740 vssvc.exe Token: SeRestorePrivilege 1740 vssvc.exe Token: SeAuditPrivilege 1740 vssvc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exeae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exeexplorer.exedescription pid process target process PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1808 wrote to memory of 1632 1808 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe PID 1632 wrote to memory of 1944 1632 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe explorer.exe PID 1632 wrote to memory of 1944 1632 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe explorer.exe PID 1632 wrote to memory of 1944 1632 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe explorer.exe PID 1632 wrote to memory of 1944 1632 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe explorer.exe PID 1632 wrote to memory of 1944 1632 ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe explorer.exe PID 1944 wrote to memory of 808 1944 explorer.exe vssadmin.exe PID 1944 wrote to memory of 808 1944 explorer.exe vssadmin.exe PID 1944 wrote to memory of 808 1944 explorer.exe vssadmin.exe PID 1944 wrote to memory of 808 1944 explorer.exe vssadmin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe"C:\Users\Admin\AppData\Local\Temp\ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe"C:\Users\Admin\AppData\Local\Temp\ae25dc288f5ef1ecfe4f7d6728a1814020813d2958434a06011778c206f575c9.exe"2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\system32\explorer.exe"3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet4⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ywynugoxasijikec\01000000Filesize
554KB
MD5c5601e89f4bfe5cd379c8ab61f1f6097
SHA1cd94af1f1e85fac5c8d49e237d9520c04f484187
SHA256ad96e48c1f59a3e104ef8f313b6892b7a6d7791098ddc2f995c9169a29cd1052
SHA512c1609e27ca5c415503d41942762c1ec4daf558150e1b1cfddbe4463bac922b4908e4a83ac4b389bf8902ce860d17a29031d61f90b9b221e02664e9d0d92b9e90
-
memory/808-79-0x0000000000000000-mapping.dmp
-
memory/1632-66-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1632-77-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1632-61-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1632-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1632-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1632-65-0x000000000040A61E-mapping.dmp
-
memory/1632-55-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1632-68-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1632-60-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1632-58-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1808-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1944-73-0x00000000000EA160-mapping.dmp
-
memory/1944-75-0x0000000074751000-0x0000000074753000-memory.dmpFilesize
8KB
-
memory/1944-71-0x00000000000D0000-0x000000000010C000-memory.dmpFilesize
240KB
-
memory/1944-69-0x00000000000D0000-0x000000000010C000-memory.dmpFilesize
240KB
-
memory/1944-78-0x00000000000D0000-0x000000000010C000-memory.dmpFilesize
240KB
-
memory/1944-80-0x0000000072201000-0x0000000072203000-memory.dmpFilesize
8KB