1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88

General

Target

1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe
Size

224KB
MD5

165da37ff60e1a16bb29d6529a6e38c9
SHA1

235fc1f44df435e02135d6266e149194a81b492a
SHA256

1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88
SHA512

ad9e6cf3b917934ce4220c9d082c47e10b203801acfc7b23e52afda855cea302da95f25213e7340c5ca9dc1d9f7a4b91f94bf1875c6e2529ca829508e43991dd
SSDEEP

3072:EXyqNsMoBu8ZVpl2mclbj4Uvx+8ysNOu+2eRcKksU61JkkX39RLrw4ySKUbax2+l:bqN5op4LnbmlrZW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exehuyis.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	huyis.exe

Executes dropped EXE 1 IoCs

Processes:

huyis.exe

pid process

2044 huyis.exe

pid	process
2044	huyis.exe

Loads dropped DLL 2 IoCs

Processes:

1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe

pid	process
1504	1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe
1504	1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exehuyis.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /z"	1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /j"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /d"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /i"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /w"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /c"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /z"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /y"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /l"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /s"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /v"	huyis.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /m"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /o"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /k"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /t"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /e"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /x"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /g"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /h"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /a"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /p"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /q"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /n"	huyis.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /b"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /f"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /u"	huyis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\huyis = "C:\\Users\\Admin\\huyis.exe /r"	huyis.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exehuyis.exe

pid	process
1504	1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe
2044	huyis.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exehuyis.exe

pid process

1504 1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe
2044 huyis.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe

description	pid	process	target process
PID 1504 wrote to memory of 2044	1504	1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe	huyis.exe
PID 1504 wrote to memory of 2044	1504	1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe	huyis.exe
PID 1504 wrote to memory of 2044	1504	1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe	huyis.exe
PID 1504 wrote to memory of 2044	1504	1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe	huyis.exe

C:\Users\Admin\AppData\Local\Temp\1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe
"C:\Users\Admin\AppData\Local\Temp\1a90619b1b1878aef411d92867919db4a16e7a2e362c01f58725d8031b137b88.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\huyis.exe
  "C:\Users\Admin\huyis.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\huyis.exe

Filesize
224KB

MD5
c11980d88b207989de1d50a916499749

SHA1
ac85928e511688992a1a2483ff851237c848cf56

SHA256
7549f17d73e35422ceca84c8bb3365cd91db2be86aec6bc9dba28be7bd617b76

SHA512
148628016d7f627a8b2500746cdaa44f3ef66e86b4490904a558f21550f112e9749c7fd78d658e1506f32a4de87f20780325d2a95b8b40fc66482e9d4bd78828

Download Submit
C:\Users\Admin\huyis.exe

Filesize
224KB

MD5
c11980d88b207989de1d50a916499749

SHA1
ac85928e511688992a1a2483ff851237c848cf56

SHA256
7549f17d73e35422ceca84c8bb3365cd91db2be86aec6bc9dba28be7bd617b76

SHA512
148628016d7f627a8b2500746cdaa44f3ef66e86b4490904a558f21550f112e9749c7fd78d658e1506f32a4de87f20780325d2a95b8b40fc66482e9d4bd78828

Download Submit
\Users\Admin\huyis.exe

Filesize
224KB

MD5
c11980d88b207989de1d50a916499749

SHA1
ac85928e511688992a1a2483ff851237c848cf56

SHA256
7549f17d73e35422ceca84c8bb3365cd91db2be86aec6bc9dba28be7bd617b76

SHA512
148628016d7f627a8b2500746cdaa44f3ef66e86b4490904a558f21550f112e9749c7fd78d658e1506f32a4de87f20780325d2a95b8b40fc66482e9d4bd78828

Download Submit
\Users\Admin\huyis.exe

Filesize
224KB

MD5
c11980d88b207989de1d50a916499749

SHA1
ac85928e511688992a1a2483ff851237c848cf56

SHA256
7549f17d73e35422ceca84c8bb3365cd91db2be86aec6bc9dba28be7bd617b76

SHA512
148628016d7f627a8b2500746cdaa44f3ef66e86b4490904a558f21550f112e9749c7fd78d658e1506f32a4de87f20780325d2a95b8b40fc66482e9d4bd78828

Download Submit
memory/1504-56-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/2044-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads