Analysis
-
max time kernel
162s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 22:14
Static task
static1
Behavioral task
behavioral1
Sample
d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe
-
Size
212KB
-
MD5
5b3a2a62f453c4f8ff39a7621524f864
-
SHA1
637fe1107a5749cf005b5ec28319def5e9586f8d
-
SHA256
d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb
-
SHA512
a3460499d0db35793fbda9ecdb89056c4543d4167d938d70fcf22f027fa5887f4a4cafd0919aceb4843e6322dd57ac42ce14a7b50e6d1076d3c2f19776abe780
-
SSDEEP
6144:UOFwzWQuO8J0+6ChTw3b1affiRnH78MDxGaoBKnvmb7/D26dhHmpfXJNa2V:1FwP8J0tATw3bkffI78MDxGaoBKnvmbW
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ywmut.exe -
Executes dropped EXE 1 IoCs
pid Process 2436 ywmut.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe -
Adds Run key to start application 2 TTPs 55 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /R" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /P" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /w" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /v" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /f" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /L" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /Y" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /z" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /y" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /I" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /S" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /X" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /E" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /t" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /U" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /B" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /d" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /M" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /i" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /e" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /J" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /q" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /F" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /x" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /K" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /m" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /D" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /V" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /A" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /N" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /Q" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /b" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /u" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /j" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /Z" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /o" ywmut.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /O" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /l" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /h" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /C" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /C" d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /k" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /W" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /p" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /G" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /g" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /r" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /c" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /H" ywmut.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /T" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /s" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /a" ywmut.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ywmut = "C:\\Users\\Admin\\ywmut.exe /n" ywmut.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4956 d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe 4956 d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe 2436 ywmut.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4956 d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe 2436 ywmut.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4956 wrote to memory of 2436 4956 d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe 85 PID 4956 wrote to memory of 2436 4956 d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe 85 PID 4956 wrote to memory of 2436 4956 d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe"C:\Users\Admin\AppData\Local\Temp\d4a05a89d1f3879c67c46f70a0ee70b2bc3a3c37cf4c3d2fbcc9fca3ea61aeeb.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\ywmut.exe"C:\Users\Admin\ywmut.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2436
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
212KB
MD5682cec866d92418b4d450a7eb37d22dc
SHA1058fe891bf469b79e66325e9fb61be4ec4d8182d
SHA256ec3225db960c35bbd9ee1e5ff320ab185c43bfd11c57c7c1167f1cccd473a7da
SHA5122a41928966f5b675852e36df20f888208d8d8815ba431e4c1f62d08c37847d8685ab9308669a93378302fcb0f4387874eec7c0138dca688170df884135032d64
-
Filesize
212KB
MD5682cec866d92418b4d450a7eb37d22dc
SHA1058fe891bf469b79e66325e9fb61be4ec4d8182d
SHA256ec3225db960c35bbd9ee1e5ff320ab185c43bfd11c57c7c1167f1cccd473a7da
SHA5122a41928966f5b675852e36df20f888208d8d8815ba431e4c1f62d08c37847d8685ab9308669a93378302fcb0f4387874eec7c0138dca688170df884135032d64