983d625fcf16f42d3fead61360f885b6990a66364fd8aebe86a9890974626b60

Analysis

max time kernel
142s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13/09/2022, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

YouTube Proxy Viewer v1.0.exe
Size

806KB
MD5

139b38e1b9d62ae812909046d9703481
SHA1

d1b05419556212cb05fcdadeb93eb93f7856454c
SHA256

c1266489d112c62eb4a5f9575cc2331e1f33cd73bdec36a7a6f7a76b598154bc
SHA512

cabb897749ae9c1a8a3b1f6089434217d0906283b81c800d7261f692c17ad21e1fc210efbd0634aa7eeea3571cfe2d0b88c274183333a8d5d95edb2b8d00df15
SSDEEP

24576:nwCwGzxgABEyqY6M3e9lypKb1+YIVXZUTti:nwCwMxgAeyqY6M3e9IqIVJMti

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4852	UserOOBE.exe
4832	winsrvhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 49 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	Qt5Core.cfg
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Qt5Core.cfg
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Qt5Core.cfg
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "4"	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Qt5Core.cfg
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "2"	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Qt5Core.cfg
Set value (data)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "4294967295"	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Qt5Core.cfg
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Qt5Core.cfg
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Qt5Core.cfg

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4896	Qt5Core.cfg

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4896	Qt5Core.cfg
4896	Qt5Core.cfg
4896	Qt5Core.cfg

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 4852	836	YouTube Proxy Viewer v1.0.exe	84
PID 836 wrote to memory of 4852	836	YouTube Proxy Viewer v1.0.exe	84
PID 836 wrote to memory of 4852	836	YouTube Proxy Viewer v1.0.exe	84
PID 836 wrote to memory of 4896	836	YouTube Proxy Viewer v1.0.exe	85
PID 836 wrote to memory of 4896	836	YouTube Proxy Viewer v1.0.exe	85
PID 836 wrote to memory of 4896	836	YouTube Proxy Viewer v1.0.exe	85
PID 836 wrote to memory of 4832	836	YouTube Proxy Viewer v1.0.exe	86
PID 836 wrote to memory of 4832	836	YouTube Proxy Viewer v1.0.exe	86
PID 836 wrote to memory of 4832	836	YouTube Proxy Viewer v1.0.exe	86

C:\Users\Admin\AppData\Local\Temp\YouTube Proxy Viewer v1.0.exe
"C:\Users\Admin\AppData\Local\Temp\YouTube Proxy Viewer v1.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\ProgramData\UserOOBE\UserOOBE.exe
  C:\ProgramData\\UserOOBE\\UserOOBE.exe ,.
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Users\Admin\AppData\Local\Temp\Qt5Core.cfg
  Qt5Core.cfg
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4896
- C:\ProgramData\winsrvhost\winsrvhost.exe
  C:\ProgramData\\winsrvhost\\winsrvhost.exe
  2⤵
  - Executes dropped EXE
  PID:4832

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\UserOOBE\UserOOBE.exe

Filesize
251KB

MD5
bc6f4d046400dfdb6d778fb1926766b6

SHA1
ce51637b97296bc4427bffcbc30273532fc2a212

SHA256
29615fb0394b6ca88d8982d5c005292de3b96e2096b3b6994a55eaf1fdd5c847

SHA512
b15a0f2111a485b65a5490f874646dd12c2f62a19912a1cb2d95a9c40fb42cdd659ca2acaab80d3268d570ea09ae46225721aab28567f718860bed0a71258555

Download Submit
C:\ProgramData\UserOOBE\UserOOBE.exe

Filesize
251KB

MD5
bc6f4d046400dfdb6d778fb1926766b6

SHA1
ce51637b97296bc4427bffcbc30273532fc2a212

SHA256
29615fb0394b6ca88d8982d5c005292de3b96e2096b3b6994a55eaf1fdd5c847

SHA512
b15a0f2111a485b65a5490f874646dd12c2f62a19912a1cb2d95a9c40fb42cdd659ca2acaab80d3268d570ea09ae46225721aab28567f718860bed0a71258555

Download Submit
C:\ProgramData\winsrvhost\winsrvhost.exe

Filesize
284KB

MD5
a317a0cc1f48e6529d5e87f4212a518b

SHA1
a15b80d2427f47a3efc963630132534146734547

SHA256
30ecbcec13191cd883eb65634af367c4c69cb82ddc3d7a79d40b7786a9547b27

SHA512
d923e2e7624ba764052ce72d27d20aadbade84cfc39ce8ed2d20c9bf9045a70b533cb8a6d05db0ffff3f66595d40273c02d2bf9a36e6baf4cf52b4700905cc4f

Download Submit
C:\ProgramData\winsrvhost\winsrvhost.exe

Filesize
284KB

MD5
a317a0cc1f48e6529d5e87f4212a518b

SHA1
a15b80d2427f47a3efc963630132534146734547

SHA256
30ecbcec13191cd883eb65634af367c4c69cb82ddc3d7a79d40b7786a9547b27

SHA512
d923e2e7624ba764052ce72d27d20aadbade84cfc39ce8ed2d20c9bf9045a70b533cb8a6d05db0ffff3f66595d40273c02d2bf9a36e6baf4cf52b4700905cc4f

Download Submit
memory/4896-140-0x00000000054D0000-0x000000000556C000-memory.dmp

Filesize
624KB

Download
memory/4896-139-0x00000000007E0000-0x000000000082C000-memory.dmp

Filesize
304KB

Download
memory/4896-141-0x0000000005B20000-0x00000000060C4000-memory.dmp

Filesize
5.6MB

Download
memory/4896-142-0x0000000005610000-0x00000000056A2000-memory.dmp

Filesize
584KB

Download
memory/4896-143-0x00000000055A0000-0x00000000055AA000-memory.dmp

Filesize
40KB

Download
memory/4896-144-0x00000000057A0000-0x00000000057F6000-memory.dmp

Filesize
344KB

Download
memory/4896-145-0x00000000053CC000-0x00000000053CF000-memory.dmp

Filesize
12KB

Download
memory/4896-146-0x000000000DD30000-0x000000000E4D6000-memory.dmp

Filesize
7.6MB

Download
memory/4896-147-0x00000000053CC000-0x00000000053CF000-memory.dmp

Filesize
12KB

Download