a127e09a548a05765b4cf553ae6a92148a52254d6990f5bc1daeb06b0b3fa523

Analysis

max time kernel
152s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a127e09a548a05765b4cf553ae6a92148a52254d6990f5bc1daeb06b0b3fa523.exe
Size

304KB
MD5

6535027dc744b7948659706907ba5f20
SHA1

60c262b9644be36bb9c941fd7c6ba274e02c2ae2
SHA256

a127e09a548a05765b4cf553ae6a92148a52254d6990f5bc1daeb06b0b3fa523
SHA512

ec2d8e5771eb13af779035cef01514b578ebdb126cca2bca91068005ce76b20c9aef3d13d542cf83bd003409bfe3686b59d5b4bcfd1dea4ce98be656d163d9d6
SSDEEP

6144:8cP+wbqVxSVN8tMdEfOjthSDwcz0pziDfjDaND:DJb04sWIzmYfCND

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3968	yvaciq.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	yvaciq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yvaciq = "C:\\Users\\Admin\\AppData\\Roaming\\Cainna\\yvaciq.exe"	yvaciq.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2244 set thread context of 4388	2244	a127e09a548a05765b4cf553ae6a92148a52254d6990f5bc1daeb06b0b3fa523.exe	83

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe
3968	yvaciq.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 3968	2244	a127e09a548a05765b4cf553ae6a92148a52254d6990f5bc1daeb06b0b3fa523.exe	82
PID 2244 wrote to memory of 3968	2244	a127e09a548a05765b4cf553ae6a92148a52254d6990f5bc1daeb06b0b3fa523.exe	82
PID 2244 wrote to memory of 3968	2244	a127e09a548a05765b4cf553ae6a92148a52254d6990f5bc1daeb06b0b3fa523.exe	82
PID 3968 wrote to memory of 2516	3968	yvaciq.exe	77
PID 3968 wrote to memory of 2516	3968	yvaciq.exe	77
PID 3968 wrote to memory of 2516	3968	yvaciq.exe	77
PID 3968 wrote to memory of 2516	3968	yvaciq.exe	77
PID 3968 wrote to memory of 2516	3968	yvaciq.exe	77
PID 3968 wrote to memory of 2528	3968	yvaciq.exe	76
PID 3968 wrote to memory of 2528	3968	yvaciq.exe	76
PID 3968 wrote to memory of 2528	3968	yvaciq.exe	76
PID 3968 wrote to memory of 2528	3968	yvaciq.exe	76
PID 3968 wrote to memory of 2528	3968	yvaciq.exe	76
PID 3968 wrote to memory of 2636	3968	yvaciq.exe	73
PID 3968 wrote to memory of 2636	3968	yvaciq.exe	73
PID 3968 wrote to memory of 2636	3968	yvaciq.exe	73
PID 3968 wrote to memory of 2636	3968	yvaciq.exe	73
PID 3968 wrote to memory of 2636	3968	yvaciq.exe	73
PID 3968 wrote to memory of 2596	3968	yvaciq.exe	68
PID 3968 wrote to memory of 2596	3968	yvaciq.exe	68
PID 3968 wrote to memory of 2596	3968	yvaciq.exe	68
PID 3968 wrote to memory of 2596	3968	yvaciq.exe	68
PID 3968 wrote to memory of 2596	3968	yvaciq.exe	68
PID 3968 wrote to memory of 944	3968	yvaciq.exe	67
PID 3968 wrote to memory of 944	3968	yvaciq.exe	67
PID 3968 wrote to memory of 944	3968	yvaciq.exe	67
PID 3968 wrote to memory of 944	3968	yvaciq.exe	67
PID 3968 wrote to memory of 944	3968	yvaciq.exe	67
PID 3968 wrote to memory of 3256	3968	yvaciq.exe	66
PID 3968 wrote to memory of 3256	3968	yvaciq.exe	66
PID 3968 wrote to memory of 3256	3968	yvaciq.exe	66
PID 3968 wrote to memory of 3256	3968	yvaciq.exe	66
PID 3968 wrote to memory of 3256	3968	yvaciq.exe	66
PID 3968 wrote to memory of 3368	3968	yvaciq.exe	65
PID 3968 wrote to memory of 3368	3968	yvaciq.exe	65
PID 3968 wrote to memory of 3368	3968	yvaciq.exe	65
PID 3968 wrote to memory of 3368	3968	yvaciq.exe	65
PID 3968 wrote to memory of 3368	3968	yvaciq.exe	65
PID 3968 wrote to memory of 3472	3968	yvaciq.exe	63
PID 3968 wrote to memory of 3472	3968	yvaciq.exe	63
PID 3968 wrote to memory of 3472	3968	yvaciq.exe	63
PID 3968 wrote to memory of 3472	3968	yvaciq.exe	63
PID 3968 wrote to memory of 3472	3968	yvaciq.exe	63
PID 3968 wrote to memory of 3568	3968	yvaciq.exe	62
PID 3968 wrote to memory of 3568	3968	yvaciq.exe	62
PID 3968 wrote to memory of 3568	3968	yvaciq.exe	62
PID 3968 wrote to memory of 3568	3968	yvaciq.exe	62
PID 3968 wrote to memory of 3568	3968	yvaciq.exe	62
PID 3968 wrote to memory of 3768	3968	yvaciq.exe	61
PID 3968 wrote to memory of 3768	3968	yvaciq.exe	61
PID 3968 wrote to memory of 3768	3968	yvaciq.exe	61
PID 3968 wrote to memory of 3768	3968	yvaciq.exe	61
PID 3968 wrote to memory of 3768	3968	yvaciq.exe	61
PID 3968 wrote to memory of 4724	3968	yvaciq.exe	59
PID 3968 wrote to memory of 4724	3968	yvaciq.exe	59
PID 3968 wrote to memory of 4724	3968	yvaciq.exe	59
PID 3968 wrote to memory of 4724	3968	yvaciq.exe	59
PID 3968 wrote to memory of 4724	3968	yvaciq.exe	59
PID 3968 wrote to memory of 3964	3968	yvaciq.exe	47
PID 3968 wrote to memory of 3964	3968	yvaciq.exe	47
PID 3968 wrote to memory of 3964	3968	yvaciq.exe	47
PID 3968 wrote to memory of 3964	3968	yvaciq.exe	47
PID 3968 wrote to memory of 3964	3968	yvaciq.exe	47
PID 3968 wrote to memory of 2244	3968	yvaciq.exe	81

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3964

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4724

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3768

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3568

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3472

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3368

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:944

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2596
- C:\Users\Admin\AppData\Local\Temp\a127e09a548a05765b4cf553ae6a92148a52254d6990f5bc1daeb06b0b3fa523.exe
  "C:\Users\Admin\AppData\Local\Temp\a127e09a548a05765b4cf553ae6a92148a52254d6990f5bc1daeb06b0b3fa523.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Users\Admin\AppData\Roaming\Cainna\yvaciq.exe
    "C:\Users\Admin\AppData\Roaming\Cainna\yvaciq.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3968
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\FNJA26B.bat"
    3⤵
    PID:4388

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2528

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2516

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FNJA26B.bat

Filesize
303B

MD5
f046d0635261b68f88dd2e311e86a708

SHA1
74b539ae5756de3d474146bb63875a7fa3e9959d

SHA256
52cd18d278c39c8508263f14ed57b1a6ece7f6810d0901c085d14d0ca8429db9

SHA512
65b0a29f24560f90cfdd9cfb2673e257e40cda38d3b7873efd972cb65003fad894117bf085957f697fae4e3bc1912890fa35725dbfa810d11082a349d46925de

Download Submit
C:\Users\Admin\AppData\Roaming\Cainna\yvaciq.exe

Filesize
304KB

MD5
46b060c2020ef93be21aadfccf58ec3f

SHA1
782c82bb96828f125bc98da1eaac792ed48ea8f8

SHA256
64c88c8550a9e853db876636f0694c881e960d2ace3f49ecf45b1fc4534cc357

SHA512
55594af4691c07791bf79ab2adfe5afb8ab54533b18061a4a30f2f64ab9b95d3bee22369d7d86a8b0c787510f4af3dda805e011afe934bf21be3de7d0b39354f

Download Submit
C:\Users\Admin\AppData\Roaming\Cainna\yvaciq.exe

Filesize
304KB

MD5
46b060c2020ef93be21aadfccf58ec3f

SHA1
782c82bb96828f125bc98da1eaac792ed48ea8f8

SHA256
64c88c8550a9e853db876636f0694c881e960d2ace3f49ecf45b1fc4534cc357

SHA512
55594af4691c07791bf79ab2adfe5afb8ab54533b18061a4a30f2f64ab9b95d3bee22369d7d86a8b0c787510f4af3dda805e011afe934bf21be3de7d0b39354f

Download Submit
memory/2244-148-0x00000000021D0000-0x0000000002219000-memory.dmp

Filesize
292KB

Download
memory/2244-143-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2244-144-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2244-142-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2244-146-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2244-145-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2244-147-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/2244-135-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/2244-136-0x0000000000401000-0x0000000000442000-memory.dmp

Filesize
260KB

Download
memory/3968-137-0x0000000000000000-mapping.dmp

Download
memory/3968-140-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4388-150-0x0000000000110000-0x0000000000159000-memory.dmp

Filesize
292KB

Download
memory/4388-152-0x0000000000110000-0x0000000000159000-memory.dmp

Filesize
292KB

Download
memory/4388-151-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4388-153-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4388-154-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4388-155-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4388-158-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4388-157-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4388-156-0x000000006FFF0000-0x0000000070000000-memory.dmp

Filesize
64KB

Download
memory/4388-149-0x0000000000000000-mapping.dmp

Download
memory/4388-160-0x0000000000110000-0x0000000000159000-memory.dmp

Filesize
292KB

Download