d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb

Analysis

max time kernel
174s
max time network
84s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb.exe
Size

116KB
MD5

624a4a3a70a6e5fcdca5feacead07b00
SHA1

a0ee257f785f69be828d429e7338f6f77326e7a9
SHA256

d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb
SHA512

67bea0b5c6f0c1d417d28a6c40a46999c9f388fc4bab887181dbab6b18c210fcf7bb3e9a9a259396723edb9e678d8be1ccd1038d6d401a5653304366b63b94fe
SSDEEP

768:AhCE45rcRyalaaToIfR2Q3qIOumoGSNqy3CDrng6hJcEy59+B/p:A3srcJd2Q6I++t3CDrvJcb9+B/p

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yaioh.exe

Executes dropped EXE 1 IoCs

pid	Process
612	yaioh.exe

Loads dropped DLL 2 IoCs

pid	Process
1368	d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb.exe
1368	d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	yaioh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yaioh = "C:\\Users\\Admin\\yaioh.exe"	yaioh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1368	d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb.exe
612	yaioh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 612	1368	d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb.exe	28
PID 1368 wrote to memory of 612	1368	d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb.exe	28
PID 1368 wrote to memory of 612	1368	d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb.exe	28
PID 1368 wrote to memory of 612	1368	d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb.exe	28

C:\Users\Admin\AppData\Local\Temp\d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb.exe
"C:\Users\Admin\AppData\Local\Temp\d86196afe8bfda40be731a8da6e7e97e25527da5d735ec9886b424d749ffcadb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\yaioh.exe
  "C:\Users\Admin\yaioh.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  PID:612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\yaioh.exe

Filesize
116KB

MD5
6530b2848d5d42a72e3e54e740999f1d

SHA1
aa1655a644c114969c6242f326a7d03940bbd198

SHA256
1a8df7f9af70484a9b3c70119e04700c269f7e59ac69905f2353af4b3a0ef9c1

SHA512
a3f12dd4844bab80ca9595e5154743754b45e6af7576403104d81e069e929d0b012bb3c61ef71bbd7624de826694af4afc87c1686c4871a8e3fb79330af0052a

Download Submit
C:\Users\Admin\yaioh.exe

Filesize
116KB

MD5
6530b2848d5d42a72e3e54e740999f1d

SHA1
aa1655a644c114969c6242f326a7d03940bbd198

SHA256
1a8df7f9af70484a9b3c70119e04700c269f7e59ac69905f2353af4b3a0ef9c1

SHA512
a3f12dd4844bab80ca9595e5154743754b45e6af7576403104d81e069e929d0b012bb3c61ef71bbd7624de826694af4afc87c1686c4871a8e3fb79330af0052a

Download Submit
\Users\Admin\yaioh.exe

Filesize
116KB

MD5
6530b2848d5d42a72e3e54e740999f1d

SHA1
aa1655a644c114969c6242f326a7d03940bbd198

SHA256
1a8df7f9af70484a9b3c70119e04700c269f7e59ac69905f2353af4b3a0ef9c1

SHA512
a3f12dd4844bab80ca9595e5154743754b45e6af7576403104d81e069e929d0b012bb3c61ef71bbd7624de826694af4afc87c1686c4871a8e3fb79330af0052a

Download Submit
\Users\Admin\yaioh.exe

Filesize
116KB

MD5
6530b2848d5d42a72e3e54e740999f1d

SHA1
aa1655a644c114969c6242f326a7d03940bbd198

SHA256
1a8df7f9af70484a9b3c70119e04700c269f7e59ac69905f2353af4b3a0ef9c1

SHA512
a3f12dd4844bab80ca9595e5154743754b45e6af7576403104d81e069e929d0b012bb3c61ef71bbd7624de826694af4afc87c1686c4871a8e3fb79330af0052a

Download Submit
memory/1368-56-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads