df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb

Analysis

max time kernel
142s
max time network
137s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe
Size

101KB
MD5

fd6d6bc1d96da3233620ad58a4eb7833
SHA1

fc9a5d7c1214b09b1c61d31d90124417b15fc668
SHA256

df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb
SHA512

729f5017b2a7b76be9a1a00693580b938b73a6e37a0197e73976ac9c708df26fe2d05ee3e2870ff3a43ed1f716f83ab1451262463507524aa1ff749eda8a24a5
SSDEEP

1536:6Dc/pULCHdf0T16zyyXMtH289WZveKsxxxxFbbbsi:6D/LxB6zyyXMEIOveci

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
904	lyehost.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
2008	attrib.exe

Deletes itself 1 IoCs

pid	Process
840	cmd.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\lyehost.exe	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe
File opened for modification	C:\Windows\Debug\lyehost.exe	attrib.exe
File created	C:\Windows\Debug\lyehost.exe	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	lyehost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	lyehost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1792	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2008	1792	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe	26
PID 1792 wrote to memory of 2008	1792	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe	26
PID 1792 wrote to memory of 2008	1792	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe	26
PID 1792 wrote to memory of 2008	1792	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe	26
PID 1792 wrote to memory of 840	1792	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe	29
PID 1792 wrote to memory of 840	1792	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe	29
PID 1792 wrote to memory of 840	1792	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe	29
PID 1792 wrote to memory of 840	1792	df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe	29

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2008	attrib.exe

C:\Users\Admin\AppData\Local\Temp\df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe
"C:\Users\Admin\AppData\Local\Temp\df89dd6b04cc209866efe37ef9d9854f20fa4687680f3c228a90f85f3d6fb9bb.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\lyehost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:2008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DF89DD~1.EXE > nul
  2⤵
  - Deletes itself
  PID:840

C:\Windows\Debug\lyehost.exe
C:\Windows\Debug\lyehost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\lyehost.exe

Filesize
101KB

MD5
8bf1604e243bd357215e480cb113ac25

SHA1
4d909a5c0f91905288f5e5a4e584bd53b3c9648e

SHA256
255f5e3263dba55b95aab4401c2789c0f4e3acc52dd0b04bc7ac41ee3997349d

SHA512
c3e52c546323c16c61f768db5da43477f72132a2840f5c3a66976da60174a2353583bd81c3775678ecb87ef2676af98ced44e42cad1bb5acb70eaacde94a81f2

Download Submit
C:\Windows\debug\lyehost.exe

Filesize
101KB

MD5
8bf1604e243bd357215e480cb113ac25

SHA1
4d909a5c0f91905288f5e5a4e584bd53b3c9648e

SHA256
255f5e3263dba55b95aab4401c2789c0f4e3acc52dd0b04bc7ac41ee3997349d

SHA512
c3e52c546323c16c61f768db5da43477f72132a2840f5c3a66976da60174a2353583bd81c3775678ecb87ef2676af98ced44e42cad1bb5acb70eaacde94a81f2

Download Submit
memory/840-59-0x0000000000000000-mapping.dmp

Download
memory/1792-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads