Analysis
-
max time kernel
185s -
max time network
70s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:20
Static task
static1
Behavioral task
behavioral1
Sample
d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe
Resource
win10v2004-20220812-en
General
-
Target
d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe
-
Size
224KB
-
MD5
3d3a52e072aea26529fa912e58ddd180
-
SHA1
4d61a2598335b139e181e31cae9f18c637e2e7e1
-
SHA256
d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1
-
SHA512
f28424a3372d880e9c062a8b6e047c4bf3f906ceecb4494c77a08e4b281e75de8281f32384c9724f9827dcb6d3f74f5e710160c8197c3d900bbcc36f9364c95b
-
SSDEEP
3072:U5IIlrLsIqrgl4iEzjKTF40qVA0KNBxAlDy:U5IEEIqrgCHpXA0KZAE
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exeyozug.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yozug.exe -
Executes dropped EXE 1 IoCs
Processes:
yozug.exepid process 828 yozug.exe -
Loads dropped DLL 2 IoCs
Processes:
d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exepid process 1056 d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe 1056 d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe -
Adds Run key to start application 2 TTPs 53 IoCs
Processes:
yozug.exed6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /y" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /C" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /X" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /J" d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /d" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /m" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /b" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /g" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /o" yozug.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /N" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /O" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /I" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /J" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /a" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /q" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /u" yozug.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /B" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /U" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /M" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /i" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /K" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /h" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /p" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /k" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /x" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /W" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /t" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /w" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /c" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /L" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /v" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /G" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /j" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /f" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /A" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /P" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /T" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /R" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /V" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /Q" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /l" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /r" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /Y" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /e" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /S" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /D" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /H" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /n" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /z" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /Z" yozug.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yozug = "C:\\Users\\Admin\\yozug.exe /E" yozug.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exeyozug.exepid process 1056 d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe 828 yozug.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exeyozug.exepid process 1056 d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe 828 yozug.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exedescription pid process target process PID 1056 wrote to memory of 828 1056 d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe yozug.exe PID 1056 wrote to memory of 828 1056 d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe yozug.exe PID 1056 wrote to memory of 828 1056 d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe yozug.exe PID 1056 wrote to memory of 828 1056 d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe yozug.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe"C:\Users\Admin\AppData\Local\Temp\d6230d40a9370aa71d241a5a8719fcc2d95de6cf1f7be2ef1d989670bbd04ad1.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\yozug.exe"C:\Users\Admin\yozug.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\yozug.exeFilesize
224KB
MD5c1332738b62bb0bc4b20cc6c570d9217
SHA1758aee9b11722a9067fb38f64985b2c7786da2f1
SHA256602a054a935adcc26dbbef0fca8f7ce4cae65c660ae03d4ef4843764ccbeca37
SHA5129e2f71127a1828b1f43a5ff2390215cf70f129c00e8247dea4bb1a804461307f3d9f59807654c8d95f1ea89e6358b126031bf7ce53e50f8361c0cbc3ce31a1a1
-
C:\Users\Admin\yozug.exeFilesize
224KB
MD5c1332738b62bb0bc4b20cc6c570d9217
SHA1758aee9b11722a9067fb38f64985b2c7786da2f1
SHA256602a054a935adcc26dbbef0fca8f7ce4cae65c660ae03d4ef4843764ccbeca37
SHA5129e2f71127a1828b1f43a5ff2390215cf70f129c00e8247dea4bb1a804461307f3d9f59807654c8d95f1ea89e6358b126031bf7ce53e50f8361c0cbc3ce31a1a1
-
\Users\Admin\yozug.exeFilesize
224KB
MD5c1332738b62bb0bc4b20cc6c570d9217
SHA1758aee9b11722a9067fb38f64985b2c7786da2f1
SHA256602a054a935adcc26dbbef0fca8f7ce4cae65c660ae03d4ef4843764ccbeca37
SHA5129e2f71127a1828b1f43a5ff2390215cf70f129c00e8247dea4bb1a804461307f3d9f59807654c8d95f1ea89e6358b126031bf7ce53e50f8361c0cbc3ce31a1a1
-
\Users\Admin\yozug.exeFilesize
224KB
MD5c1332738b62bb0bc4b20cc6c570d9217
SHA1758aee9b11722a9067fb38f64985b2c7786da2f1
SHA256602a054a935adcc26dbbef0fca8f7ce4cae65c660ae03d4ef4843764ccbeca37
SHA5129e2f71127a1828b1f43a5ff2390215cf70f129c00e8247dea4bb1a804461307f3d9f59807654c8d95f1ea89e6358b126031bf7ce53e50f8361c0cbc3ce31a1a1
-
memory/828-59-0x0000000000000000-mapping.dmp
-
memory/1056-56-0x0000000075E31000-0x0000000075E33000-memory.dmpFilesize
8KB