f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14

General

Target

f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
Size

44KB
MD5

260a26a815aaddabce59cb132c9211e0
SHA1

33a8b938d75c2219171864588effb777a046c0e9
SHA256

f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14
SHA512

17d8c5399e7139e77328d60a5e59bcbe926a728a3d1d405097db821df251905d03be8ee3d506415f471a4378928851a599b24878c50f3dcdaf15457cdeede194
SSDEEP

768:bh/Hd29JLlNAXe04H7cHPHYmug6UXQm1dIZE2ocOT77e:bEhNpHyj6S3T77

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

yoautuf.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yoautuf.exe

Executes dropped EXE 1 IoCs

Processes:

yoautuf.exe

pid process

3680 yoautuf.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

yoautuf.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yoautuf = "C:\\Users\\Admin\\yoautuf.exe"	yoautuf.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\	yoautuf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

yoautuf.exe

pid	process
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe
3680	yoautuf.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exeyoautuf.exe

pid process

4668 f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
3680 yoautuf.exe

pid	process
4668	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
3680	yoautuf.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exeyoautuf.exe

description	pid	process	target process
PID 4668 wrote to memory of 3680	4668	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe	yoautuf.exe
PID 4668 wrote to memory of 3680	4668	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe	yoautuf.exe
PID 4668 wrote to memory of 3680	4668	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe	yoautuf.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
PID 3680 wrote to memory of 4668	3680	yoautuf.exe	f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe

C:\Users\Admin\AppData\Local\Temp\f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe
"C:\Users\Admin\AppData\Local\Temp\f997ee0a78766765e659290f9bd39aa1bb81bb95c86ddfde38c47517c5c39f14.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668

C:\Users\Admin\yoautuf.exe
"C:\Users\Admin\yoautuf.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\yoautuf.exe

Filesize
44KB

MD5
9cbecad225adad207e307fac43d6d665

SHA1
3f03031f6c070d8bc93807f44fad4b642de3d166

SHA256
96576d9b89bede2d2806fde3dabc4b4e75fc177d9a36de5af31a085505d9b602

SHA512
f0a050e9a053afe6be8def215b107d16367c16807a5112152308b5c0e94ad8b94c76bd2363b951b7ab907b31e986189615cfcda3e9910e1808bb948966f38f0a

Download Submit
C:\Users\Admin\yoautuf.exe

Filesize
44KB

MD5
9cbecad225adad207e307fac43d6d665

SHA1
3f03031f6c070d8bc93807f44fad4b642de3d166

SHA256
96576d9b89bede2d2806fde3dabc4b4e75fc177d9a36de5af31a085505d9b602

SHA512
f0a050e9a053afe6be8def215b107d16367c16807a5112152308b5c0e94ad8b94c76bd2363b951b7ab907b31e986189615cfcda3e9910e1808bb948966f38f0a

Download Submit
memory/3680-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads