b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543

General

Target

b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
Size

552KB
MD5

67a532c43f067779df6eac4ae0acc07c
SHA1

cbf2efd61bebfa08613cf66a66b87e0a8a259af8
SHA256

b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543
SHA512

f5e80473ad2747f596ee48d56f167ab58964249fffadb2dec1119ff4f4b200a6115845f3d8702dfff3a0ef57a33428bd41afd57d8cecd6e509b8cebc22cc749a
SSDEEP

6144:vUZjWquq3bBE4oKTKFvhAp080KqKoePisPa2hHoFXl5iwtWTFM2qWqWMBugSl3NP:8ZjLucE4/KR7KqKoe6sPJhIFW9TZP9h

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\opimefog = "\"C:\\Windows\\yhiterad.exe\""	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exeb76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe

description	pid	process	target process
PID 704 set thread context of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 1724 set thread context of 1940	1724	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\yhiterad.exe explorer.exe
File created C:\Windows\yhiterad.exe explorer.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

956 vssadmin.exe

description	ioc	process
File opened for modification	C:\Windows\yhiterad.exe	explorer.exe
File created	C:\Windows\yhiterad.exe	explorer.exe

pid	process
956	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe

pid process

704 b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1748 vssvc.exe
Token: SeRestorePrivilege 1748 vssvc.exe
Token: SeAuditPrivilege 1748 vssvc.exe

pid	process
704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe

description	pid	process
Token: SeBackupPrivilege	1748	vssvc.exe
Token: SeRestorePrivilege	1748	vssvc.exe
Token: SeAuditPrivilege	1748	vssvc.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exeb76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exeexplorer.exe

description	pid	process	target process
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 704 wrote to memory of 1724	704	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
PID 1724 wrote to memory of 1940	1724	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	explorer.exe
PID 1724 wrote to memory of 1940	1724	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	explorer.exe
PID 1724 wrote to memory of 1940	1724	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	explorer.exe
PID 1724 wrote to memory of 1940	1724	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	explorer.exe
PID 1724 wrote to memory of 1940	1724	b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe	explorer.exe
PID 1940 wrote to memory of 956	1940	explorer.exe	vssadmin.exe
PID 1940 wrote to memory of 956	1940	explorer.exe	vssadmin.exe
PID 1940 wrote to memory of 956	1940	explorer.exe	vssadmin.exe
PID 1940 wrote to memory of 956	1940	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
"C:\Users\Admin\AppData\Local\Temp\b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:704

C:\Users\Admin\AppData\Local\Temp\b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe
"C:\Users\Admin\AppData\Local\Temp\b76c07f9a07db7fb8bf83464890d6981ff7ba6bbb51cafb725d37f5be2e1d543.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1724

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ycofydacamomuzax\01000000
Filesize
552KB

MD5
01eef1a1e7db6d9d4e70641fe5b614a0

SHA1
358419679d5a0301effc4fbf5ed1042bd0a59e4e

SHA256
d17174c7ee78c80ef2eee849e7209bc5b75e83855b94f4163971612578234ace

SHA512
f41656ec598c0c28b6a0afbaedffbce3d10e44119d60500efb1fcb47b864f8fda818c11f1ef4d2afe6c043a9d16b5e39dd772037f96883368430a4f5c8525058

Download Submit
memory/704-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download
memory/956-80-0x0000000000000000-mapping.dmp

Download
memory/1724-69-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1724-58-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1724-62-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1724-64-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1724-66-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1724-65-0x000000000040A61E-mapping.dmp

Download
memory/1724-68-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1724-60-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1724-55-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1724-61-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1724-78-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1940-76-0x0000000074571000-0x0000000074573000-memory.dmp

Filesize
8KB

Download
memory/1940-74-0x000000000009A140-mapping.dmp

Download
memory/1940-72-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1940-79-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1940-70-0x0000000000080000-0x00000000000BC000-memory.dmp

Filesize
240KB

Download
memory/1940-81-0x0000000072121000-0x0000000072123000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads