71213be1116e5ace654ee4071e3f2c83e0a39fd0efe0246b1659b9520f31f2b6

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hyword/hyword/hyinput.exe
Size

76KB
MD5

d017597920e6db7e9e31296a8f654ed2
SHA1

9250c0aa7ee5da68a72f529da2455fdbb7874b80
SHA256

05ff92e5422b5a150bd254a8e9a917e0503ec11ca3219cff7f4c4c982f8e918b
SHA512

c3ef62e1e68ba00955f1e5de9828fd00dde332e0946d598cbd8ae6a31854bd78f79cb5a6395d4653e3d50652d2171319e10b643741d27edc77fd6bda3edf644b
SSDEEP

1536:oJNVrI2W3Oh4dDgFpTS+oD6LZlglddasJEZOC8TOPO5lp0Ustkznh489AaJEGV:oG2AOh3F1po8Tyd1JRC8QGltstEy8Oat

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

hyinput.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation hyinput.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	hyinput.exe

Modifies registry class 45 IoCs

Processes:

hyinput.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}\4.0\0\win32	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\ProxyStubClsid32	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\InprocServer32\ThreadingModel = "Apartment"	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\VERSION\ = "4.0"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}\4.0	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}\4.0\FLAGS\ = "0"	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}\4.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hyword\\hyword\\wbfc.dll"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}\4.0\HELPDIR	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\InprocServer32	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}\4.0\FLAGS	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\ProxyStubClsid32	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\TypeLib\ = "{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}"	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\play78.GetCodeClass\Clsid	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\ProxyStubClsid	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}\4.0\0	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\ = "GetCodeClass"	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\TypeLib\Version = "4.0"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\VERSION	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\play78.GetCodeClass	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\play78.GetCodeClass\Clsid\ = "{D228C3B7-781A-41D7-8E5A-9216CC1F9194}"	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\play78.GetCodeClass\ = "play78.GetCodeClass"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\Programmable	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\ = "_GetCodeClass"	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\TypeLib\ = "{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hyword\\hyword\\wbfc.dll"	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\TypeLib\ = "{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\TypeLib	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}\4.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hyword\\hyword"	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\ = "_GetCodeClass"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\TypeLib	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\TypeLib	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\ = "play78.GetCodeClass"	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D9AC3251-B484-43EA-971B-E8BD8D6A8F7D}\4.0\ = "play78"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{78F9225D-4FDE-4CA4-B017-30E2304AED8F}\TypeLib\Version = "4.0"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\ProgID	hyinput.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\ProgID\ = "play78.GetCodeClass"	hyinput.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D228C3B7-781A-41D7-8E5A-9216CC1F9194}\Implemented Categories	hyinput.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

hyinput.exe

pid process

1080 hyinput.exe

pid	process
1080	hyinput.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXESpeechUXWiz.exe

description	pid	process
Token: 33	1268	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1268	AUDIODG.EXE
Token: 33	4952	SpeechUXWiz.exe
Token: SeIncBasePriorityPrivilege	4952	SpeechUXWiz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

hyinput.exe

pid process

1080 hyinput.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

hyinput.exe

pid process

1080 hyinput.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

hyinput.exe

pid process

1080 hyinput.exe
1080 hyinput.exe
1080 hyinput.exe
1080 hyinput.exe

pid	process
1080	hyinput.exe

pid	process
1080	hyinput.exe

pid	process
1080	hyinput.exe
1080	hyinput.exe
1080	hyinput.exe
1080	hyinput.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

hyinput.exesapisvr.exe

description	pid	process	target process
PID 1080 wrote to memory of 2200	1080	hyinput.exe	sapisvr.exe
PID 1080 wrote to memory of 2200	1080	hyinput.exe	sapisvr.exe
PID 2200 wrote to memory of 4952	2200	sapisvr.exe	SpeechUXWiz.exe
PID 2200 wrote to memory of 4952	2200	sapisvr.exe	SpeechUXWiz.exe

C:\Users\Admin\AppData\Local\Temp\hyword\hyword\hyinput.exe
"C:\Users\Admin\AppData\Local\Temp\hyword\hyword\hyinput.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\Speech\Common\sapisvr.exe
"C:\Windows\Speech\Common\sapisvr.exe" -SpeechApp
2⤵
- Suspicious use of WriteProcessMemory
PID:2200

C:\Windows\system32\Speech\SpeechUX\SpeechUXWiz.exe
"C:\Windows\system32\Speech\SpeechUX\SpeechUXWiz.exe" UserEnrollment,en-US,HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech\RecoProfiles\Tokens\{395F4005-F9F2-4B94-A9E2-ED7D869C0F0A},65552,0,""
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4952

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x41c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_4CC00D43FD14419A979CECD5D14A6CB7.dat

Filesize
940B

MD5
4be166fd3b3d349bcea5d862adb30276

SHA1
6be64b67fb7ef52ef0c975ca9d3f6b2776885c63

SHA256
98214431c606befde4b70aa88e07279193dd77879bd0be33f0999a84e5e5bb61

SHA512
91f03fe3f01f9f4053bf11090705caf6fd82fc884d6c91bfa640daca72a094c717570fbbcfc9e85d09bbf78dfea7eb2db609f2cd3fd43ae3d361b1ed2308a1cb

Download Submit
memory/1080-132-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1080-135-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/1080-137-0x0000000011000000-0x000000001105C000-memory.dmp

Filesize
368KB

Download
memory/1080-141-0x0000000011000000-0x000000001105C000-memory.dmp

Filesize
368KB

Download
memory/1080-142-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1080-143-0x0000000010000000-0x00000000100A5000-memory.dmp

Filesize
660KB

Download
memory/2200-138-0x0000000000000000-mapping.dmp

Download
memory/4952-139-0x0000000000000000-mapping.dmp

Download