Analysis
-
max time kernel
46s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 23:21
Static task
static1
Behavioral task
behavioral1
Sample
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe
Resource
win7-20220812-en
General
-
Target
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe
-
Size
2.5MB
-
MD5
7dad5ca2096cbe129c0dade6cb2c915f
-
SHA1
7ef1eeab904b7b3afcc9e203be5e664388eb3198
-
SHA256
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
-
SHA512
87c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
SSDEEP
24576:+5phTHwpeGenqhURy3e45mDyyg2lcV+q2lcV2sQ288nLS9XTJDsCSz1H3a:+5phTQpeZnqhURyOAbCC+fCc27n2wRHK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
YHKO.exepid process 852 YHKO.exe -
Loads dropped DLL 6 IoCs
Processes:
cmd.exeWerFault.exepid process 1948 cmd.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe 1616 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1616 852 WerFault.exe YHKO.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1916 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exeYHKO.exepowershell.exepowershell.exepid process 1980 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe 852 YHKO.exe 268 powershell.exe 1816 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exeYHKO.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1980 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe Token: SeDebugPrivilege 852 YHKO.exe Token: SeDebugPrivilege 268 powershell.exe Token: SeDebugPrivilege 1816 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.execmd.exeYHKO.execmd.exedescription pid process target process PID 1980 wrote to memory of 1816 1980 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe powershell.exe PID 1980 wrote to memory of 1816 1980 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe powershell.exe PID 1980 wrote to memory of 1816 1980 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe powershell.exe PID 1980 wrote to memory of 1948 1980 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe cmd.exe PID 1980 wrote to memory of 1948 1980 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe cmd.exe PID 1980 wrote to memory of 1948 1980 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe cmd.exe PID 1948 wrote to memory of 1916 1948 cmd.exe timeout.exe PID 1948 wrote to memory of 1916 1948 cmd.exe timeout.exe PID 1948 wrote to memory of 1916 1948 cmd.exe timeout.exe PID 1948 wrote to memory of 852 1948 cmd.exe YHKO.exe PID 1948 wrote to memory of 852 1948 cmd.exe YHKO.exe PID 1948 wrote to memory of 852 1948 cmd.exe YHKO.exe PID 852 wrote to memory of 268 852 YHKO.exe powershell.exe PID 852 wrote to memory of 268 852 YHKO.exe powershell.exe PID 852 wrote to memory of 268 852 YHKO.exe powershell.exe PID 852 wrote to memory of 1032 852 YHKO.exe cmd.exe PID 852 wrote to memory of 1032 852 YHKO.exe cmd.exe PID 852 wrote to memory of 1032 852 YHKO.exe cmd.exe PID 1032 wrote to memory of 1560 1032 cmd.exe schtasks.exe PID 1032 wrote to memory of 1560 1032 cmd.exe schtasks.exe PID 1032 wrote to memory of 1560 1032 cmd.exe schtasks.exe PID 852 wrote to memory of 1616 852 YHKO.exe WerFault.exe PID 852 wrote to memory of 1616 852 YHKO.exe WerFault.exe PID 852 wrote to memory of 1616 852 YHKO.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe"C:\Users\Admin\AppData\Local\Temp\42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp406B.tmp.bat""2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\ProgramData\dlllib\YHKO.exe"C:\ProgramData\dlllib\YHKO.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "C:\ProgramData\dlllib\YHKO.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "C:\ProgramData\dlllib\YHKO.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 852 -s 8604⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\dlllib\YHKO.exeFilesize
2.5MB
MD57dad5ca2096cbe129c0dade6cb2c915f
SHA17ef1eeab904b7b3afcc9e203be5e664388eb3198
SHA25642bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
SHA51287c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
C:\ProgramData\dlllib\YHKO.exeFilesize
2.5MB
MD57dad5ca2096cbe129c0dade6cb2c915f
SHA17ef1eeab904b7b3afcc9e203be5e664388eb3198
SHA25642bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
SHA51287c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
C:\Users\Admin\AppData\Local\Temp\tmp406B.tmp.batFilesize
139B
MD5605831ea0f0a4428293b3bd3d2c7613d
SHA1103d409347468549e992a0790a3e325f11370c00
SHA2562dcf8295c98e26502acaddeb94425edaa2b5082ab686d5090ee8d524e967418d
SHA5123a16e98e8716d7acb7168800d864de9258e7b488926eb42cf1247a3c37d7b781fa820965c1266e974425ee525c9194f43c29101c1a8706892cee775b76ab8702
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD51c5798dee8c9eeae33837b863faac554
SHA17ce78c0b3bc291b81430e6ab02e5fcad18d37acf
SHA2564052f8c97e237daef91b3f14a1a0c7c7c43c8c4f967a55845fc4b4afed4f0014
SHA512a84eade91392d9a7038f1f38c92b835df4f82f02b3d98472d8fc3eb36231321d4839475b1354f549969004f4670068f1e694133941dca3cbdf97949b9dca355c
-
\ProgramData\dlllib\YHKO.exeFilesize
2.5MB
MD57dad5ca2096cbe129c0dade6cb2c915f
SHA17ef1eeab904b7b3afcc9e203be5e664388eb3198
SHA25642bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
SHA51287c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
\ProgramData\dlllib\YHKO.exeFilesize
2.5MB
MD57dad5ca2096cbe129c0dade6cb2c915f
SHA17ef1eeab904b7b3afcc9e203be5e664388eb3198
SHA25642bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
SHA51287c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
\ProgramData\dlllib\YHKO.exeFilesize
2.5MB
MD57dad5ca2096cbe129c0dade6cb2c915f
SHA17ef1eeab904b7b3afcc9e203be5e664388eb3198
SHA25642bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
SHA51287c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
\ProgramData\dlllib\YHKO.exeFilesize
2.5MB
MD57dad5ca2096cbe129c0dade6cb2c915f
SHA17ef1eeab904b7b3afcc9e203be5e664388eb3198
SHA25642bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
SHA51287c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
\ProgramData\dlllib\YHKO.exeFilesize
2.5MB
MD57dad5ca2096cbe129c0dade6cb2c915f
SHA17ef1eeab904b7b3afcc9e203be5e664388eb3198
SHA25642bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
SHA51287c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
\ProgramData\dlllib\YHKO.exeFilesize
2.5MB
MD57dad5ca2096cbe129c0dade6cb2c915f
SHA17ef1eeab904b7b3afcc9e203be5e664388eb3198
SHA25642bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
SHA51287c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
memory/268-120-0x000000000246B000-0x000000000248A000-memory.dmpFilesize
124KB
-
memory/268-111-0x000007FEF57F0000-0x000007FEF634D000-memory.dmpFilesize
11.4MB
-
memory/268-114-0x0000000002464000-0x0000000002467000-memory.dmpFilesize
12KB
-
memory/268-110-0x000007FEECB20000-0x000007FEED543000-memory.dmpFilesize
10.1MB
-
memory/268-127-0x000000000246B000-0x000000000248A000-memory.dmpFilesize
124KB
-
memory/268-105-0x0000000000000000-mapping.dmp
-
memory/268-126-0x0000000002464000-0x0000000002467000-memory.dmpFilesize
12KB
-
memory/852-113-0x000007FEFB4F0000-0x000007FEFB705000-memory.dmpFilesize
2.1MB
-
memory/852-102-0x000007FEFF0F0000-0x000007FEFF2F3000-memory.dmpFilesize
2.0MB
-
memory/852-118-0x000007FEFEE90000-0x000007FEFEF67000-memory.dmpFilesize
860KB
-
memory/852-115-0x000007FEF27A0000-0x000007FEF28D8000-memory.dmpFilesize
1.2MB
-
memory/852-117-0x00000000006C0000-0x0000000000701000-memory.dmpFilesize
260KB
-
memory/852-116-0x0000000000870000-0x0000000000B50000-memory.dmpFilesize
2.9MB
-
memory/852-104-0x000007FEF3740000-0x000007FEF386C000-memory.dmpFilesize
1.2MB
-
memory/852-103-0x0000000000870000-0x0000000000B50000-memory.dmpFilesize
2.9MB
-
memory/852-101-0x000007FEFED60000-0x000007FEFEE8D000-memory.dmpFilesize
1.2MB
-
memory/852-83-0x0000000000000000-mapping.dmp
-
memory/852-100-0x000007FEF4E00000-0x000007FEF57EC000-memory.dmpFilesize
9.9MB
-
memory/852-87-0x000007FEF6900000-0x000007FEF696F000-memory.dmpFilesize
444KB
-
memory/852-91-0x0000000000870000-0x0000000000B50000-memory.dmpFilesize
2.9MB
-
memory/852-92-0x0000000077100000-0x00000000771FA000-memory.dmpFilesize
1000KB
-
memory/852-90-0x000007FEFD440000-0x000007FEFD4A7000-memory.dmpFilesize
412KB
-
memory/852-88-0x000007FEF6860000-0x000007FEF68FC000-memory.dmpFilesize
624KB
-
memory/852-98-0x000007FEF6490000-0x000007FEF6587000-memory.dmpFilesize
988KB
-
memory/852-99-0x000007FEFF010000-0x000007FEFF0EB000-memory.dmpFilesize
876KB
-
memory/852-97-0x000007FEFEF70000-0x000007FEFEFE1000-memory.dmpFilesize
452KB
-
memory/852-96-0x000007FEFD070000-0x000007FEFD0DC000-memory.dmpFilesize
432KB
-
memory/852-95-0x0000000076FE0000-0x00000000770FF000-memory.dmpFilesize
1.1MB
-
memory/852-94-0x000007FEFE550000-0x000007FEFE5EF000-memory.dmpFilesize
636KB
-
memory/852-93-0x00000000006C0000-0x0000000000701000-memory.dmpFilesize
260KB
-
memory/1032-109-0x0000000000000000-mapping.dmp
-
memory/1560-112-0x0000000000000000-mapping.dmp
-
memory/1616-121-0x0000000000000000-mapping.dmp
-
memory/1816-119-0x000000000250B000-0x000000000252A000-memory.dmpFilesize
124KB
-
memory/1816-73-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmpFilesize
8KB
-
memory/1816-79-0x000007FEECB20000-0x000007FEED543000-memory.dmpFilesize
10.1MB
-
memory/1816-72-0x0000000000000000-mapping.dmp
-
memory/1816-89-0x0000000002504000-0x0000000002507000-memory.dmpFilesize
12KB
-
memory/1816-128-0x0000000002504000-0x0000000002507000-memory.dmpFilesize
12KB
-
memory/1816-81-0x000007FEF57F0000-0x000007FEF634D000-memory.dmpFilesize
11.4MB
-
memory/1816-129-0x000000000250B000-0x000000000252A000-memory.dmpFilesize
124KB
-
memory/1916-77-0x0000000000000000-mapping.dmp
-
memory/1948-74-0x0000000000000000-mapping.dmp
-
memory/1980-68-0x000007FEFED60000-0x000007FEFEE8D000-memory.dmpFilesize
1.2MB
-
memory/1980-65-0x00000000000E0000-0x0000000000121000-memory.dmpFilesize
260KB
-
memory/1980-78-0x00000000012C0000-0x00000000015A0000-memory.dmpFilesize
2.9MB
-
memory/1980-63-0x000007FEF6590000-0x000007FEF6687000-memory.dmpFilesize
988KB
-
memory/1980-66-0x000007FEFF010000-0x000007FEFF0EB000-memory.dmpFilesize
876KB
-
memory/1980-64-0x00000000012C0000-0x00000000015A0000-memory.dmpFilesize
2.9MB
-
memory/1980-75-0x000007FEFEB60000-0x000007FEFEB7F000-memory.dmpFilesize
124KB
-
memory/1980-67-0x000007FEF5960000-0x000007FEF634C000-memory.dmpFilesize
9.9MB
-
memory/1980-80-0x00000000000E0000-0x0000000000121000-memory.dmpFilesize
260KB
-
memory/1980-55-0x000007FEF6900000-0x000007FEF696F000-memory.dmpFilesize
444KB
-
memory/1980-71-0x000007FEF6460000-0x000007FEF658C000-memory.dmpFilesize
1.2MB
-
memory/1980-62-0x000007FEFEF70000-0x000007FEFEFE1000-memory.dmpFilesize
452KB
-
memory/1980-61-0x000007FEFD070000-0x000007FEFD0DC000-memory.dmpFilesize
432KB
-
memory/1980-60-0x0000000076FE0000-0x00000000770FF000-memory.dmpFilesize
1.1MB
-
memory/1980-59-0x000007FEFE550000-0x000007FEFE5EF000-memory.dmpFilesize
636KB
-
memory/1980-58-0x0000000077100000-0x00000000771FA000-memory.dmpFilesize
1000KB
-
memory/1980-57-0x000007FEFD440000-0x000007FEFD4A7000-memory.dmpFilesize
412KB
-
memory/1980-70-0x00000000012C0000-0x00000000015A0000-memory.dmpFilesize
2.9MB
-
memory/1980-69-0x000007FEFF0F0000-0x000007FEFF2F3000-memory.dmpFilesize
2.0MB
-
memory/1980-56-0x000007FEF6860000-0x000007FEF68FC000-memory.dmpFilesize
624KB