8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93

Analysis

max time kernel
191s
max time network
124s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe
Size

112KB
MD5

66e6249e3bef44d8a1fae62a32d644f7
SHA1

1ba9c54e542012680023e0bd5b82d79da823e99a
SHA256

8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93
SHA512

bf1f6fa7a6baf4e0db5860a3315981c1f2a8b20bfcbfc65f64660fbe2f48221902ee4d9863f886850f1f391a2538a253c72082120a7b06b6b6857f84e9ee2949
SSDEEP

1536:affZOdUCJwVuYipwFJ0T72mocTDQtF8Jx0CT67hDmT5OWq:sfMy5FJ0T72mBT+F8x+7hDmT5O/

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yaoxe.exe

Executes dropped EXE 1 IoCs

pid	Process
872	yaoxe.exe

Loads dropped DLL 2 IoCs

pid	Process
1360	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe
1360	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /r"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /t"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /z"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /m"	yaoxe.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /q"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /a"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /e"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /w"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /g"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /n"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /v"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /c"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /f"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /l"	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /j"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /l"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /o"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /i"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /x"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /u"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /p"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /d"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /k"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /b"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /y"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /s"	yaoxe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaoxe = "C:\\Users\\Admin\\yaoxe.exe /h"	yaoxe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1360	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe
872	yaoxe.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1360	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe
872	yaoxe.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 872	1360	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe	27
PID 1360 wrote to memory of 872	1360	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe	27
PID 1360 wrote to memory of 872	1360	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe	27
PID 1360 wrote to memory of 872	1360	8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe	27

C:\Users\Admin\AppData\Local\Temp\8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe
"C:\Users\Admin\AppData\Local\Temp\8b9774b9248cb3651596e5888d1e307beeb4e5b6411ab195f56ff60ce8741a93.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\yaoxe.exe
  "C:\Users\Admin\yaoxe.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\yaoxe.exe

Filesize
112KB

MD5
10d704af27060c54dbd96096cc636c9a

SHA1
2c91997df264abfc571336cad7612550b82025a0

SHA256
b5985ad71e46254bf784bb12baf9db337032992d4e45b727484b7198e1ef4c1d

SHA512
fb5fe427a362dd6d9b5d858bf9da0a97131856413b65c2e158ef669f511c99e76fe6be4729d5e162820fa087d8ff479f52575a343aa80deabe40b5d4c262f2c6

Download Submit
C:\Users\Admin\yaoxe.exe

Filesize
112KB

MD5
10d704af27060c54dbd96096cc636c9a

SHA1
2c91997df264abfc571336cad7612550b82025a0

SHA256
b5985ad71e46254bf784bb12baf9db337032992d4e45b727484b7198e1ef4c1d

SHA512
fb5fe427a362dd6d9b5d858bf9da0a97131856413b65c2e158ef669f511c99e76fe6be4729d5e162820fa087d8ff479f52575a343aa80deabe40b5d4c262f2c6

Download Submit
\Users\Admin\yaoxe.exe

Filesize
112KB

MD5
10d704af27060c54dbd96096cc636c9a

SHA1
2c91997df264abfc571336cad7612550b82025a0

SHA256
b5985ad71e46254bf784bb12baf9db337032992d4e45b727484b7198e1ef4c1d

SHA512
fb5fe427a362dd6d9b5d858bf9da0a97131856413b65c2e158ef669f511c99e76fe6be4729d5e162820fa087d8ff479f52575a343aa80deabe40b5d4c262f2c6

Download Submit
\Users\Admin\yaoxe.exe

Filesize
112KB

MD5
10d704af27060c54dbd96096cc636c9a

SHA1
2c91997df264abfc571336cad7612550b82025a0

SHA256
b5985ad71e46254bf784bb12baf9db337032992d4e45b727484b7198e1ef4c1d

SHA512
fb5fe427a362dd6d9b5d858bf9da0a97131856413b65c2e158ef669f511c99e76fe6be4729d5e162820fa087d8ff479f52575a343aa80deabe40b5d4c262f2c6

Download Submit
memory/872-67-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/872-71-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1360-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1360-57-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1360-65-0x00000000027B0000-0x00000000027CD000-memory.dmp

Filesize
116KB

Download
memory/1360-66-0x00000000027B0000-0x00000000027CD000-memory.dmp

Filesize
116KB

Download
memory/1360-69-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1360-70-0x00000000027B0000-0x00000000027CD000-memory.dmp

Filesize
116KB

Download