fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d

General

Target

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
Size

220KB
MD5

4d2ecaee7d1124a4e17f1cac127f2b96
SHA1

6f0bc78ae426bd42400a4472bab258585257bb4c
SHA256

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d
SHA512

23fa24ebdf72966877d08a9460976978c95d050268b018c07a7dce9fa21321336474fd4bba47f04ae06761b0ee9f40847a9a7ad37885cbf0385468c3260f0df0
SSDEEP

3072:PUOu+kr8YUL4qx9RIHgil3UuhSa3U3dD8d6Oy+MIrnj3J+Nhi:cO7ko15x9SHVeOj0Q

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exeyisif.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yisif.exe

Executes dropped EXE 1 IoCs

Processes:

yisif.exe

pid process

1128 yisif.exe

pid	process
1128	yisif.exe

Loads dropped DLL 2 IoCs

Processes:

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe

pid	process
1292	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
1292	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe

Adds Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

yisif.exefa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /n"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /q"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /z"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /g"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /e"	yisif.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /f"	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /h"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /i"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /c"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /t"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /k"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /u"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /v"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /w"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /s"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /d"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /y"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /p"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /o"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /l"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /b"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /x"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /f"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /m"	yisif.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /r"	yisif.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\yisif = "C:\\Users\\Admin\\yisif.exe /a"	yisif.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exeyisif.exe

pid	process
1292	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe
1128	yisif.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exeyisif.exe

pid process

1292 fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
1128 yisif.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe

description	pid	process	target process
PID 1292 wrote to memory of 1128	1292	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe	yisif.exe
PID 1292 wrote to memory of 1128	1292	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe	yisif.exe
PID 1292 wrote to memory of 1128	1292	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe	yisif.exe
PID 1292 wrote to memory of 1128	1292	fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe	yisif.exe

C:\Users\Admin\AppData\Local\Temp\fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe
"C:\Users\Admin\AppData\Local\Temp\fa3b94157c124546ca0981100a6c2c095167b1d8577c026119c604c745baea0d.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\yisif.exe
"C:\Users\Admin\yisif.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\yisif.exe

Filesize
220KB

MD5
a3b6c217794a357278b49410f3bde62f

SHA1
f6aa5441258d830168f4cccce7975413e7ef99a1

SHA256
3b21b753befef55d286fa7dc7defb0d37f2950beaab256afc964c34e7add1272

SHA512
1a7d0e440f07868e604030d8494a5859216cdd1fac0b7118827a57fd2ee418fce110f838d1d2299b0bf0be2684828e7b61bf6bf12b994aa1d4158905b25906e5

Download Submit
C:\Users\Admin\yisif.exe

Filesize
220KB

MD5
a3b6c217794a357278b49410f3bde62f

SHA1
f6aa5441258d830168f4cccce7975413e7ef99a1

SHA256
3b21b753befef55d286fa7dc7defb0d37f2950beaab256afc964c34e7add1272

SHA512
1a7d0e440f07868e604030d8494a5859216cdd1fac0b7118827a57fd2ee418fce110f838d1d2299b0bf0be2684828e7b61bf6bf12b994aa1d4158905b25906e5

Download Submit
\Users\Admin\yisif.exe

Filesize
220KB

MD5
a3b6c217794a357278b49410f3bde62f

SHA1
f6aa5441258d830168f4cccce7975413e7ef99a1

SHA256
3b21b753befef55d286fa7dc7defb0d37f2950beaab256afc964c34e7add1272

SHA512
1a7d0e440f07868e604030d8494a5859216cdd1fac0b7118827a57fd2ee418fce110f838d1d2299b0bf0be2684828e7b61bf6bf12b994aa1d4158905b25906e5

Download Submit
\Users\Admin\yisif.exe

Filesize
220KB

MD5
a3b6c217794a357278b49410f3bde62f

SHA1
f6aa5441258d830168f4cccce7975413e7ef99a1

SHA256
3b21b753befef55d286fa7dc7defb0d37f2950beaab256afc964c34e7add1272

SHA512
1a7d0e440f07868e604030d8494a5859216cdd1fac0b7118827a57fd2ee418fce110f838d1d2299b0bf0be2684828e7b61bf6bf12b994aa1d4158905b25906e5

Download Submit
memory/1128-59-0x0000000000000000-mapping.dmp

Download
memory/1292-56-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads