Analysis
-
max time kernel
26s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-11-2022 18:16
Static task
static1
Behavioral task
behavioral1
Sample
957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe
Resource
win7-20220812-en
General
-
Target
957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe
-
Size
1.9MB
-
MD5
ec6e22899512d507a32cadda8e8af406
-
SHA1
2957180a107a7ab59491bad0d840cfc9ba9d7aaf
-
SHA256
957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960
-
SHA512
a398bdad1a4a4d0b46d62b34d24a78f6520a5967b9d3f8324b1c2329d234e9ad383f402051e42e813247e4ea7bdc3477dfb49c09c491448a280cc88877878c9a
-
SSDEEP
49152:AkSXhixEgCOWoNGglFS5h2HKFoqv9kq23p+zY15kFm53Sy9:vSRii5HoGSSaHMoOY15kFm5Z
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ydhd.exepid process 1596 ydhd.exe -
Loads dropped DLL 4 IoCs
Processes:
957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exepid process 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ydhd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce ydhd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\92hu89v = "C:\\Users\\Admin\\92hu89v\\brpb.vbs" ydhd.exe -
Processes:
ydhd.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ydhd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ydhd.exedescription pid process target process PID 1596 set thread context of 908 1596 ydhd.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ydhd.exepid process 1596 ydhd.exe 1596 ydhd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ydhd.exedescription pid process Token: SeDebugPrivilege 1596 ydhd.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exeydhd.exedescription pid process target process PID 1912 wrote to memory of 1596 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe ydhd.exe PID 1912 wrote to memory of 1596 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe ydhd.exe PID 1912 wrote to memory of 1596 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe ydhd.exe PID 1912 wrote to memory of 1596 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe ydhd.exe PID 1912 wrote to memory of 1596 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe ydhd.exe PID 1912 wrote to memory of 1596 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe ydhd.exe PID 1912 wrote to memory of 1596 1912 957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe ydhd.exe PID 1596 wrote to memory of 908 1596 ydhd.exe RegSvcs.exe PID 1596 wrote to memory of 908 1596 ydhd.exe RegSvcs.exe PID 1596 wrote to memory of 908 1596 ydhd.exe RegSvcs.exe PID 1596 wrote to memory of 908 1596 ydhd.exe RegSvcs.exe PID 1596 wrote to memory of 908 1596 ydhd.exe RegSvcs.exe PID 1596 wrote to memory of 908 1596 ydhd.exe RegSvcs.exe PID 1596 wrote to memory of 908 1596 ydhd.exe RegSvcs.exe PID 1596 wrote to memory of 908 1596 ydhd.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe"C:\Users\Admin\AppData\Local\Temp\957da2adfac3c95032ae0b8bbba7beb7288ae7a801e5370fe816dd62b3534960.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\92hu89v\ydhd.exe"C:\Users\Admin\92hu89v\ydhd.exe" zwlru2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\92hu89v\rgymdno.LPPFilesize
56B
MD5514139d5e04621e568f933f79857044c
SHA1b5551316ed86997ffdd57e2b7346fa434af7f3b9
SHA25638348782d3eea10c23ccb8245af3dfdc80f3f7ad7c1a5e7646dcb1ebb164b633
SHA5127e4aeaa3884307cf6727347649dccd239658feb1e7849263e076eeba36a0f247f585804862cee6c8e26106f8ad85ca41219ca47f78de8651fc656686ac21add7
-
C:\Users\Admin\92hu89v\ydhd.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
C:\Users\Admin\92hu89v\yrsmudyp.UUNFilesize
1.1MB
MD596482445028885c9e4e2c73a2b475323
SHA1ffd9db6cb8111d2e0b8169a44cd4b2e997a9716d
SHA25606d99edca0fd1553a2ee123d067666fee1167a135e5fa3df0f60c627cda898be
SHA51215ca6d975095a7464b34b4c79ca242c5c7380da7e15a2f658509b9ea75f901d4dec51f65889ea2615535a62aaa47d2ecb8e4322999035de7078def4e06a4fefc
-
C:\Users\Admin\92hu89v\zwlruFilesize
306.2MB
MD54b3153d063d02079986478670f2d2423
SHA1b33167bcb41c3db0a0fc849d970e4be53fc85a21
SHA256f2c6f1cfcab0da9655494dff0e96c5441b51c4658d928c92e2e5c85a2d1b8bc0
SHA5125d9c3ea3538266f7e5dfd9d7f732039775b9c707d991668edacbf1c05145031aaca1a2e9642a61b5a1b09e35d8f877ed0467544cc7e975d3ee100b1a9a9c5059
-
\Users\Admin\92hu89v\ydhd.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\92hu89v\ydhd.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\92hu89v\ydhd.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
\Users\Admin\92hu89v\ydhd.exeFilesize
732KB
MD571d8f6d5dc35517275bc38ebcc815f9f
SHA1cae4e8c730de5a01d30aabeb3e5cb2136090ed8d
SHA256fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
SHA5124826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59
-
memory/908-66-0x000000000051BB1E-mapping.dmp
-
memory/1596-59-0x0000000000000000-mapping.dmp
-
memory/1912-54-0x0000000076031000-0x0000000076033000-memory.dmpFilesize
8KB