Analysis
-
max time kernel
190s -
max time network
234s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:18
Static task
static1
Behavioral task
behavioral1
Sample
a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe
Resource
win10v2004-20220812-en
General
-
Target
a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe
-
Size
286KB
-
MD5
0dc2f8d7a662bac9d1e0da123609aba0
-
SHA1
bc334490f0f1c22f9a3accdae35b9345e71b4d69
-
SHA256
a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050
-
SHA512
b802d059feb2b5c051f13ad11312c314138d43b64b6384cb9ec352e34b359f9fe56beb0f574e0329a8ac1751d2a7f6c638365e6914b5f740117f010beb5ccd9c
-
SSDEEP
6144:/OJGUDbfd/6+D1Hon0PB2eYlLXiygmpEeIwJ9/3H64oO5Q:iGmJ/6yTPB2tXiBmpEeIwJpX6SQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
hyci.exepid process 1484 hyci.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1768 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exepid process 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
hyci.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Utpac = "C:\\Users\\Admin\\AppData\\Roaming\\Ysno\\hyci.exe" hyci.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\Currentversion\Run hyci.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exedescription pid process target process PID 2016 set thread context of 1768 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe cmd.exe -
Processes:
a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Privacy a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0" a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe -
NTFS ADS 1 IoCs
Processes:
WinMail.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\7E036F39-00000001.eml:OECustomProperty WinMail.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
hyci.exepid process 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe 1484 hyci.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exeWinMail.exedescription pid process Token: SeSecurityPrivilege 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe Token: SeSecurityPrivilege 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe Token: SeManageVolumePrivilege 344 WinMail.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
WinMail.exepid process 344 WinMail.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exehyci.exedescription pid process target process PID 2016 wrote to memory of 1484 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe hyci.exe PID 2016 wrote to memory of 1484 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe hyci.exe PID 2016 wrote to memory of 1484 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe hyci.exe PID 2016 wrote to memory of 1484 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe hyci.exe PID 1484 wrote to memory of 1116 1484 hyci.exe taskhost.exe PID 1484 wrote to memory of 1116 1484 hyci.exe taskhost.exe PID 1484 wrote to memory of 1116 1484 hyci.exe taskhost.exe PID 1484 wrote to memory of 1116 1484 hyci.exe taskhost.exe PID 1484 wrote to memory of 1116 1484 hyci.exe taskhost.exe PID 1484 wrote to memory of 1168 1484 hyci.exe Dwm.exe PID 1484 wrote to memory of 1168 1484 hyci.exe Dwm.exe PID 1484 wrote to memory of 1168 1484 hyci.exe Dwm.exe PID 1484 wrote to memory of 1168 1484 hyci.exe Dwm.exe PID 1484 wrote to memory of 1168 1484 hyci.exe Dwm.exe PID 1484 wrote to memory of 1224 1484 hyci.exe Explorer.EXE PID 1484 wrote to memory of 1224 1484 hyci.exe Explorer.EXE PID 1484 wrote to memory of 1224 1484 hyci.exe Explorer.EXE PID 1484 wrote to memory of 1224 1484 hyci.exe Explorer.EXE PID 1484 wrote to memory of 1224 1484 hyci.exe Explorer.EXE PID 1484 wrote to memory of 2016 1484 hyci.exe a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe PID 1484 wrote to memory of 2016 1484 hyci.exe a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe PID 1484 wrote to memory of 2016 1484 hyci.exe a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe PID 1484 wrote to memory of 2016 1484 hyci.exe a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe PID 1484 wrote to memory of 2016 1484 hyci.exe a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe PID 1484 wrote to memory of 344 1484 hyci.exe WinMail.exe PID 1484 wrote to memory of 344 1484 hyci.exe WinMail.exe PID 1484 wrote to memory of 344 1484 hyci.exe WinMail.exe PID 1484 wrote to memory of 344 1484 hyci.exe WinMail.exe PID 1484 wrote to memory of 344 1484 hyci.exe WinMail.exe PID 2016 wrote to memory of 1768 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe cmd.exe PID 2016 wrote to memory of 1768 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe cmd.exe PID 2016 wrote to memory of 1768 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe cmd.exe PID 2016 wrote to memory of 1768 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe cmd.exe PID 2016 wrote to memory of 1768 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe cmd.exe PID 2016 wrote to memory of 1768 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe cmd.exe PID 2016 wrote to memory of 1768 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe cmd.exe PID 2016 wrote to memory of 1768 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe cmd.exe PID 2016 wrote to memory of 1768 2016 a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe cmd.exe PID 1484 wrote to memory of 1740 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1740 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1740 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1740 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1740 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1720 1484 hyci.exe conhost.exe PID 1484 wrote to memory of 1720 1484 hyci.exe conhost.exe PID 1484 wrote to memory of 1720 1484 hyci.exe conhost.exe PID 1484 wrote to memory of 1720 1484 hyci.exe conhost.exe PID 1484 wrote to memory of 1720 1484 hyci.exe conhost.exe PID 1484 wrote to memory of 592 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 592 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 592 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 592 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 592 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1808 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1808 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1808 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1808 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1808 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1592 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1592 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1592 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1592 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 1592 1484 hyci.exe DllHost.exe PID 1484 wrote to memory of 992 1484 hyci.exe DllHost.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe"C:\Users\Admin\AppData\Local\Temp\a766b8fee987874b95c70ef2d4240c541df3b32e17d3a80e41e0b4a00468b050.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Ysno\hyci.exe"C:\Users\Admin\AppData\Roaming\Ysno\hyci.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpd5f69d18.bat"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail.exe" -Embedding1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-589920172400504039-18254820811875247800-597754174935516391-1036802703-600415045"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpd5f69d18.batFilesize
307B
MD580bea3a3d24045ad42ec7a19d2d1a05a
SHA1c88882a8e1a96245562ea2bae2501ebf93c6d315
SHA256781094d5ddb9928528578453aabdb80ca022404711b8c401a094a8e8c75053ee
SHA512883413d4c8d2e1b494fd4aa7e8ac84e9279e11cd7308b71dbf9eaca90e71f3e56ce77a186f2cd163e5e2bafb6cb36c5933faa4b458738f7ec719b10934e8d5a5
-
C:\Users\Admin\AppData\Roaming\Ysno\hyci.exeFilesize
286KB
MD5e90d94ab94dad5ae455df550727b800a
SHA1f0f1b587202326c1902335e0ff841d5d7d5710c0
SHA25663fa815fc072f049b38ce642aafd21082ac7da7dc1ea44c2b1c6670cda8f5d9e
SHA512877b2b783c3c84d6e9a31c3a296092850d09eee7e977d7a9c12025912e076e9afdcd030eb20943569b31981d9efddc369145b5926663a38a1f5a5d3fcdaae5f6
-
C:\Users\Admin\AppData\Roaming\Ysno\hyci.exeFilesize
286KB
MD5e90d94ab94dad5ae455df550727b800a
SHA1f0f1b587202326c1902335e0ff841d5d7d5710c0
SHA25663fa815fc072f049b38ce642aafd21082ac7da7dc1ea44c2b1c6670cda8f5d9e
SHA512877b2b783c3c84d6e9a31c3a296092850d09eee7e977d7a9c12025912e076e9afdcd030eb20943569b31981d9efddc369145b5926663a38a1f5a5d3fcdaae5f6
-
\Users\Admin\AppData\Roaming\Ysno\hyci.exeFilesize
286KB
MD5e90d94ab94dad5ae455df550727b800a
SHA1f0f1b587202326c1902335e0ff841d5d7d5710c0
SHA25663fa815fc072f049b38ce642aafd21082ac7da7dc1ea44c2b1c6670cda8f5d9e
SHA512877b2b783c3c84d6e9a31c3a296092850d09eee7e977d7a9c12025912e076e9afdcd030eb20943569b31981d9efddc369145b5926663a38a1f5a5d3fcdaae5f6
-
\Users\Admin\AppData\Roaming\Ysno\hyci.exeFilesize
286KB
MD5e90d94ab94dad5ae455df550727b800a
SHA1f0f1b587202326c1902335e0ff841d5d7d5710c0
SHA25663fa815fc072f049b38ce642aafd21082ac7da7dc1ea44c2b1c6670cda8f5d9e
SHA512877b2b783c3c84d6e9a31c3a296092850d09eee7e977d7a9c12025912e076e9afdcd030eb20943569b31981d9efddc369145b5926663a38a1f5a5d3fcdaae5f6
-
memory/344-111-0x0000000003D00000-0x0000000003D39000-memory.dmpFilesize
228KB
-
memory/344-110-0x0000000003D00000-0x0000000003D39000-memory.dmpFilesize
228KB
-
memory/344-109-0x0000000003D00000-0x0000000003D39000-memory.dmpFilesize
228KB
-
memory/344-88-0x000007FEFC2B1000-0x000007FEFC2B3000-memory.dmpFilesize
8KB
-
memory/344-89-0x000007FEF6CD1000-0x000007FEF6CD3000-memory.dmpFilesize
8KB
-
memory/344-90-0x0000000002020000-0x0000000002030000-memory.dmpFilesize
64KB
-
memory/344-96-0x0000000002430000-0x0000000002440000-memory.dmpFilesize
64KB
-
memory/344-108-0x0000000003D00000-0x0000000003D39000-memory.dmpFilesize
228KB
-
memory/1116-63-0x0000000001BF0000-0x0000000001C29000-memory.dmpFilesize
228KB
-
memory/1116-68-0x0000000001BF0000-0x0000000001C29000-memory.dmpFilesize
228KB
-
memory/1116-67-0x0000000001BF0000-0x0000000001C29000-memory.dmpFilesize
228KB
-
memory/1116-66-0x0000000001BF0000-0x0000000001C29000-memory.dmpFilesize
228KB
-
memory/1116-65-0x0000000001BF0000-0x0000000001C29000-memory.dmpFilesize
228KB
-
memory/1168-71-0x0000000001AF0000-0x0000000001B29000-memory.dmpFilesize
228KB
-
memory/1168-72-0x0000000001AF0000-0x0000000001B29000-memory.dmpFilesize
228KB
-
memory/1168-74-0x0000000001AF0000-0x0000000001B29000-memory.dmpFilesize
228KB
-
memory/1168-73-0x0000000001AF0000-0x0000000001B29000-memory.dmpFilesize
228KB
-
memory/1224-80-0x0000000002230000-0x0000000002269000-memory.dmpFilesize
228KB
-
memory/1224-79-0x0000000002230000-0x0000000002269000-memory.dmpFilesize
228KB
-
memory/1224-78-0x0000000002230000-0x0000000002269000-memory.dmpFilesize
228KB
-
memory/1224-77-0x0000000002230000-0x0000000002269000-memory.dmpFilesize
228KB
-
memory/1484-103-0x0000000000480000-0x00000000004D4000-memory.dmpFilesize
336KB
-
memory/1484-112-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1484-59-0x0000000000000000-mapping.dmp
-
memory/1484-104-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1768-125-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/1768-131-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/1768-249-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/1768-133-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/1768-129-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/1768-127-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/1768-123-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/1768-121-0x00000000000636E2-mapping.dmp
-
memory/1768-120-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/1768-119-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/1768-116-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/1768-118-0x0000000000050000-0x0000000000089000-memory.dmpFilesize
228KB
-
memory/2016-86-0x0000000001E70000-0x0000000001EA9000-memory.dmpFilesize
228KB
-
memory/2016-84-0x0000000001E70000-0x0000000001EA9000-memory.dmpFilesize
228KB
-
memory/2016-56-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2016-85-0x0000000001E70000-0x0000000001EA9000-memory.dmpFilesize
228KB
-
memory/2016-83-0x0000000001E70000-0x0000000001EA9000-memory.dmpFilesize
228KB
-
memory/2016-54-0x0000000076AE1000-0x0000000076AE3000-memory.dmpFilesize
8KB
-
memory/2016-113-0x0000000001E70000-0x0000000001EBA000-memory.dmpFilesize
296KB
-
memory/2016-87-0x0000000001E70000-0x0000000001EA9000-memory.dmpFilesize
228KB
-
memory/2016-105-0x0000000001E70000-0x0000000001EBA000-memory.dmpFilesize
296KB
-
memory/2016-157-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2016-159-0x0000000001E70000-0x0000000001EA9000-memory.dmpFilesize
228KB
-
memory/2016-102-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/2016-55-0x0000000001EC0000-0x0000000001F14000-memory.dmpFilesize
336KB