0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368

General

Target

0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe
Size

172KB
MD5

01f9d912ff030872225e055901aafd4e
SHA1

06872d6e925ef74c8ed7dfd80ff34cc0bf98feb5
SHA256

0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368
SHA512

02e6579a9361fa7bd3da4fdac417dc47330987d8276961cf8a9d7fe75982ddd7a9cfb3770dae256a44df259243b0a61f0dd899d75e4084fee2fd0ea49a7197f9
SSDEEP

3072:AdAAm/ZgGrbxWjJuwGTlBLmSD+WLc1UGAnl3TPeNqNZwlA35C+9zs3WSmoJuSvf+:Ad5mBdbAFuwGTlBLmSD+WLc1UGAnl3TP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

yfxoej.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yfxoej.exe

Executes dropped EXE 1 IoCs

Processes:

yfxoej.exe

pid process

3188 yfxoej.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

yfxoej.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /h"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /o"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /c"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /x"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /Y"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /O"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /X"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /S"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /y"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /C"	yfxoej.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /T"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /e"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /j"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /l"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /n"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /R"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /G"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /B"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /f"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /P"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /I"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /U"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /g"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /E"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /Q"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /m"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /t"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /A"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /q"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /L"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /d"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /V"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /W"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /v"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /s"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /k"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /K"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /F"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /i"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /u"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /M"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /J"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /w"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /D"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /z"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /H"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /r"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /b"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /Z"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /p"	yfxoej.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yfxoej = "C:\\Users\\Admin\\yfxoej.exe /N"	yfxoej.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

yfxoej.exe

pid	process
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe
3188	yfxoej.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exeyfxoej.exe

pid process

1728 0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe
3188 yfxoej.exe

pid	process
1728	0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe
3188	yfxoej.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe

description	pid	process	target process
PID 1728 wrote to memory of 3188	1728	0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe	yfxoej.exe
PID 1728 wrote to memory of 3188	1728	0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe	yfxoej.exe
PID 1728 wrote to memory of 3188	1728	0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe	yfxoej.exe

C:\Users\Admin\AppData\Local\Temp\0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe
"C:\Users\Admin\AppData\Local\Temp\0b1fd889630cf8b2a35fc1187d028ac9bcb4bfa466034cf67aeaee5b6494b368.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\yfxoej.exe
"C:\Users\Admin\yfxoej.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3188

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\yfxoej.exe

Filesize
172KB

MD5
b0cfcc3a240d9cad2ad1edbcdd7e5557

SHA1
59824700a433b4a7a7e85b1de5a83052ee95c5c6

SHA256
e5d1def06fbe60399f3977c4b57642c58292764e4b3122feaf698789b6c0046b

SHA512
fec5c944d0a911374726d6ca0909b49cd2447acdc9248bc165575e8f525033343f68d59df9085ecbfbd125e309f2b80845bf0fa4ca942eda74bf8d9f3c06618a

Download Submit
C:\Users\Admin\yfxoej.exe

Filesize
172KB

MD5
b0cfcc3a240d9cad2ad1edbcdd7e5557

SHA1
59824700a433b4a7a7e85b1de5a83052ee95c5c6

SHA256
e5d1def06fbe60399f3977c4b57642c58292764e4b3122feaf698789b6c0046b

SHA512
fec5c944d0a911374726d6ca0909b49cd2447acdc9248bc165575e8f525033343f68d59df9085ecbfbd125e309f2b80845bf0fa4ca942eda74bf8d9f3c06618a

Download Submit
memory/3188-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads