c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5

General

Target

c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe
Size

769KB
MD5

74bef16e3abdf32b2f9dddf7fc5b94f3
SHA1

295042c167b278733b10b8f7ba1cb939bff3cb38
SHA256

c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5
SHA512

6427d80196e1673f0fef1ff2e3b1737554ec7bae4ce0de7587ba1bc01e94fcdaabb539ad07420edaefbd5141bbf67aee3e8a05e9ec38a8cba30d4875f34e72f2
SSDEEP

12288:i++pDu9YrDQKiXEfiVzhY1Iys0P9ckDveteS3HSo+XX73QcFW+I1GKhfaNtR:iz0sDNiUfiPgI91kDveYOHSo+nfI1Pw/

Score

9^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\anedekop = "\"C:\\Windows\\yxahohiv.exe\""	explorer.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exec5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe

description	pid	process	target process
PID 2144 set thread context of 4944	2144	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe
PID 4944 set thread context of 648	4944	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	explorer.exe

Drops file in Windows directory 2 IoCs

Processes:

explorer.exe

description ioc process

File opened for modification C:\Windows\yxahohiv.exe explorer.exe
File created C:\Windows\yxahohiv.exe explorer.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

5008 vssadmin.exe

description	ioc	process
File opened for modification	C:\Windows\yxahohiv.exe	explorer.exe
File created	C:\Windows\yxahohiv.exe	explorer.exe

pid	process
5008	vssadmin.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\PhishingFilter	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 2128 vssvc.exe
Token: SeRestorePrivilege 2128 vssvc.exe
Token: SeAuditPrivilege 2128 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	2128	vssvc.exe
Token: SeRestorePrivilege	2128	vssvc.exe
Token: SeAuditPrivilege	2128	vssvc.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exec5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exeexplorer.exe

description	pid	process	target process
PID 2144 wrote to memory of 4944	2144	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe
PID 2144 wrote to memory of 4944	2144	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe
PID 2144 wrote to memory of 4944	2144	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe
PID 2144 wrote to memory of 4944	2144	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe
PID 2144 wrote to memory of 4944	2144	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe
PID 4944 wrote to memory of 648	4944	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	explorer.exe
PID 4944 wrote to memory of 648	4944	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	explorer.exe
PID 4944 wrote to memory of 648	4944	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	explorer.exe
PID 4944 wrote to memory of 648	4944	c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe	explorer.exe
PID 648 wrote to memory of 5008	648	explorer.exe	vssadmin.exe
PID 648 wrote to memory of 5008	648	explorer.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe
"C:\Users\Admin\AppData\Local\Temp\c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2144

C:\Users\Admin\AppData\Local\Temp\c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe
"C:\Users\Admin\AppData\Local\Temp\c5ae1b9cafaeb836145bf56a7b63029398779f703d8872bb93563791830db3b5.exe"
2⤵
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4944

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\system32\explorer.exe"
3⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
4⤵
- Interacts with shadow copies
PID:5008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\aduqeliginopicah\01000000
Filesize
769KB

MD5
033288aa44046ff49f0e205dc57fdd25

SHA1
90f2eb463b45621d21ff60edc58afcc5125fb6eb

SHA256
7a8804b82d9ad6a87a6bb715646a5ec8b9b4d5c7d719485d7857603c05549cc6

SHA512
c846dfb33f6ff05c4d963a5cc85147389fb995c69c25b300edd02f9771d58923c46933dee1c07bcc10450f823411c9409b4daae181b47a1471b0cba4ca04c362

Download Submit
memory/648-138-0x0000000000000000-mapping.dmp

Download
memory/648-144-0x0000000000940000-0x000000000097C000-memory.dmp

Filesize
240KB

Download
memory/648-143-0x0000000000940000-0x000000000097C000-memory.dmp

Filesize
240KB

Download
memory/648-139-0x0000000000940000-0x000000000097C000-memory.dmp

Filesize
240KB

Download
memory/2144-132-0x0000000002370000-0x0000000002378000-memory.dmp

Filesize
32KB

Download
memory/4944-135-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4944-137-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4944-136-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4944-142-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4944-134-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4944-133-0x0000000000000000-mapping.dmp

Download
memory/5008-145-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads