Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-10-2022 20:30
Static task
static1
Behavioral task
behavioral1
Sample
261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5.exe
-
Size
867KB
-
MD5
cfb7c0539dab1b742392fc2faf2663bd
-
SHA1
a3022a73527089d9687dd43d1c32b82ef1ce76e0
-
SHA256
261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5
-
SHA512
4157d25fb3097595760b1b91a8fbb8290227f314429b2a77e6242df413689f1512bf184796f23b5770b220304c8ac3380ad65a68687b268f13b8fcca770bd756
-
SSDEEP
12288:SV+mz3b38lrV6avz6jJnoKdN3HBCf4wzuNE36svt0/2CyPiAoia9qHj5mgOqnTCf:S8C386jvdhHBCAzuIBFd9K5fOJmHHHK
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1900 ygejql.exe 1756 Wywz.exe -
Loads dropped DLL 4 IoCs
pid Process 868 261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5.exe 1900 ygejql.exe 1900 ygejql.exe 1756 Wywz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Keyboard Wywz.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Keyboard\Native Media Players Wywz.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Keyboard\Native Media Players\WMP Wywz.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Keyboard\Native Media Players\WMP Wywz.exe Key created \REGISTRY\USER\.DEFAULT Wywz.exe Key created \REGISTRY\USER\.DEFAULT\Software Wywz.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft Wywz.exe -
Modifies registry class 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DFC29E-B1E0-4e04-9578-8259D5601188}\ProgID Wywz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WYWZext Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\WYWZext\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wywz.exe\" -recycled -results" Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\WYWZext\ = "{31DFC29E-B1E0-4e04-9578-8259D5601188}" Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\WYWZext\ = "{31DFC29E-B1E0-4e04-9578-8259D5601188}" Wywz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WYWZext Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\WYWZext\ = "{31DFC29E-B1E0-4e04-9578-8259D5601188}" Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DFC29E-B1E0-4e04-9578-8259D5601188}\ = "Eraser Shell Extension" Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DFC29E-B1E0-4e04-9578-8259D5601188}\ProgID\ = "WYWZextMenu" Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WYWZextMenu\ = "WYWZextMenu" Wywz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WYWZext Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shell\WYWZext\ = "Óá¼WYWZ¡½²Á³ý»ØÊÕÕ¾(&E)" Wywz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\WYWZext\command Wywz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\WYWZext Wywz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DFC29E-B1E0-4e04-9578-8259D5601188} Wywz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DFC29E-B1E0-4e04-9578-8259D5601188}\InProcServer32 Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WYWZextMenu\CLSID\ = "{31DFC29E-B1E0-4e04-9578-8259D5601188}" Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\WYWZext\ = "{31DFC29E-B1E0-4e04-9578-8259D5601188}" Wywz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\Shell\WYWZext Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DFC29E-B1E0-4e04-9578-8259D5601188}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Erasext.dll" Wywz.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{31DFC29E-B1E0-4e04-9578-8259D5601188}\InProcServer32\ThreadingModel = "Apartment" Wywz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WYWZextMenu Wywz.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WYWZextMenu\CLSID Wywz.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe 1900 ygejql.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1756 Wywz.exe 1756 Wywz.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 868 wrote to memory of 1900 868 261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5.exe 27 PID 868 wrote to memory of 1900 868 261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5.exe 27 PID 868 wrote to memory of 1900 868 261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5.exe 27 PID 868 wrote to memory of 1900 868 261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5.exe 27 PID 1900 wrote to memory of 1756 1900 ygejql.exe 28 PID 1900 wrote to memory of 1756 1900 ygejql.exe 28 PID 1900 wrote to memory of 1756 1900 ygejql.exe 28 PID 1900 wrote to memory of 1756 1900 ygejql.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5.exe"C:\Users\Admin\AppData\Local\Temp\261c71f78bb6c164c4bfb65e4621f74ee0723e1ba39cf6281aa2b133f62da5e5.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\ygejql.exe"C:\Users\Admin\AppData\Local\Temp\ygejql.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\Wywz.exeWywz.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1756
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
286B
MD583321f4f5464b1646d1e4a3585f44969
SHA14177fa9218b62d14a0341d1ae28ab413b509f4b8
SHA2567e482396523ce45e98f4d583f899b41b98890d9e5f6fd54675c891a9fee4b9a2
SHA5127b8e18ba5e0453cd35b90f0f4eedfe478e19008381f708c2b133dd4dab7cc2a716ec0b6dcaa3a8cd95f6852fe66a2671cf703f14bd9f503f42ebb34f0848e045
-
Filesize
440KB
MD50f98c73634abac303e6dc32eabcde855
SHA1df0f198098383b052bc3242ce71d4f65647dbd11
SHA2562fcc6a234b243feef02d83c32c63472069c0a5b25aaeb983e250e254408b9a09
SHA512c3eef986cf1e7eab7cb04896d0bc5f89886e557a46c22a0cd79d0769005c422c6ba939a43722b16f7929032fb91f47b764471ed9f32e8b8886215d9aed10f42f
-
Filesize
220KB
MD50fe38a0fe46fb49bad510fbbf12dc3ec
SHA1ffca059e6b1b4a15366483c701ffd5109f931378
SHA256a3651f3400486ce730d60ad56aa7eac6d0b2caa85ad1c16a8ad6ac3d02531e11
SHA51286e1db99a7c0e095362f486f81071a8302907d0ea9022607694b2c9c0b1b7fc8ce98550e7b8a0017d409a41a6c6e3c1850ef71ce19b905608826e2970419962b
-
Filesize
600KB
MD5d60cda173a484ed3861f8b95efe43b6b
SHA1f91daa272390f2d7cefdb4610d296b5c1d7aa99e
SHA256b059e0c1fa26a84ac10a85b80282c37ae18fcd6f5bf3154f41b77cde8174e9fc
SHA5126c8b23de80272d0025c98d83a875e17619d4acf4ab28d07afa42f6289087e300cd1a750cb79d01eaf10429d98aec525634f8120f5ab2cd3632456673da9ee880
-
Filesize
600KB
MD5d60cda173a484ed3861f8b95efe43b6b
SHA1f91daa272390f2d7cefdb4610d296b5c1d7aa99e
SHA256b059e0c1fa26a84ac10a85b80282c37ae18fcd6f5bf3154f41b77cde8174e9fc
SHA5126c8b23de80272d0025c98d83a875e17619d4acf4ab28d07afa42f6289087e300cd1a750cb79d01eaf10429d98aec525634f8120f5ab2cd3632456673da9ee880
-
Filesize
414KB
MD5237612cfdadaec8be16d035ec6fd45ef
SHA1eabdcd246f1ee20b16d526a1334dec28d57c5d5c
SHA256b677c14ab77a68396f3c269f09a510865b59121a1f1d8598242de5a894eedd88
SHA51294aeb356365e6727481ab0c9fef0a82d75f15843549bf741f8022580cf28a8ccdc28660bd43fea9cee6508253d250da330f1ae88b495f1ee47a75dd4d23701fb
-
Filesize
414KB
MD5237612cfdadaec8be16d035ec6fd45ef
SHA1eabdcd246f1ee20b16d526a1334dec28d57c5d5c
SHA256b677c14ab77a68396f3c269f09a510865b59121a1f1d8598242de5a894eedd88
SHA51294aeb356365e6727481ab0c9fef0a82d75f15843549bf741f8022580cf28a8ccdc28660bd43fea9cee6508253d250da330f1ae88b495f1ee47a75dd4d23701fb
-
Filesize
440KB
MD50f98c73634abac303e6dc32eabcde855
SHA1df0f198098383b052bc3242ce71d4f65647dbd11
SHA2562fcc6a234b243feef02d83c32c63472069c0a5b25aaeb983e250e254408b9a09
SHA512c3eef986cf1e7eab7cb04896d0bc5f89886e557a46c22a0cd79d0769005c422c6ba939a43722b16f7929032fb91f47b764471ed9f32e8b8886215d9aed10f42f
-
Filesize
600KB
MD5d60cda173a484ed3861f8b95efe43b6b
SHA1f91daa272390f2d7cefdb4610d296b5c1d7aa99e
SHA256b059e0c1fa26a84ac10a85b80282c37ae18fcd6f5bf3154f41b77cde8174e9fc
SHA5126c8b23de80272d0025c98d83a875e17619d4acf4ab28d07afa42f6289087e300cd1a750cb79d01eaf10429d98aec525634f8120f5ab2cd3632456673da9ee880
-
Filesize
600KB
MD5d60cda173a484ed3861f8b95efe43b6b
SHA1f91daa272390f2d7cefdb4610d296b5c1d7aa99e
SHA256b059e0c1fa26a84ac10a85b80282c37ae18fcd6f5bf3154f41b77cde8174e9fc
SHA5126c8b23de80272d0025c98d83a875e17619d4acf4ab28d07afa42f6289087e300cd1a750cb79d01eaf10429d98aec525634f8120f5ab2cd3632456673da9ee880
-
Filesize
414KB
MD5237612cfdadaec8be16d035ec6fd45ef
SHA1eabdcd246f1ee20b16d526a1334dec28d57c5d5c
SHA256b677c14ab77a68396f3c269f09a510865b59121a1f1d8598242de5a894eedd88
SHA51294aeb356365e6727481ab0c9fef0a82d75f15843549bf741f8022580cf28a8ccdc28660bd43fea9cee6508253d250da330f1ae88b495f1ee47a75dd4d23701fb