Analysis
-
max time kernel
135s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
29-11-2022 08:19
General
-
Target
Yvbhq.exe
-
Size
65KB
-
MD5
9829cba45d96db58f0898ad58743a474
-
SHA1
a3f4827d0523dac0c56e91b4538bdcf14c36570f
-
SHA256
19d2e3e1f912a1fe23399b0a1c150e28e03ef0cff5dfb7d2d532f705769862b5
-
SHA512
bd4d6431ca4315ad21a1094594ca0cb68a5cca689b64b73876045e468d1ba1c03d6845b444d2936ea50e71438b44ef65fdd74ca22d2339472f2f6e53be90cd8a
-
SSDEEP
1536:pmV+3Z/ZBJEomaAsurFk5ZjXx+plbfP9HPe0/v7WYPwoMkeT1eK6G:I+JtEomapYFk5ZsFP9HmelqT1N6G
Malware Config
Signatures
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
-
Stops running service(s) 3 TTPs
-
Drops startup file 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Discovers systems in the same network 1 TTPs 2 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Yvbhq.exe"C:\Users\Admin\AppData\Local\Temp\Yvbhq.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd.exe" /C sc delete VSS2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc delete VSS3⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exe"cmd.exe" /C NET VIEW2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exeNET VIEW3⤵
- Discovers systems in the same network
-
C:\Windows\system32\cmd.exe"cmd.exe" /C NET USE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exeNET USE3⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /C NET VIEW \\RYNKSFQE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exeNET VIEW \\RYNKSFQE3⤵
- Discovers systems in the same network
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\#README#.txt2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\desktop.iniFilesize
203B
MD56c28e539b6a2aed65c2a0d68752a063f
SHA103882709eb28cf277b2bcee22563d36df98fa8e5
SHA256be0f89ef3bf43540b04edeef2ed0bd86a6a1bb97d535eda5c65f869659472a22
SHA512a9d75e4d0502ba99783240d98283618f315cc798cdc575e8e2f468db935db92260fe263f72d895bb0c5711c50fe9674bb61af08e1b47aa4119302da5b79a2f2f
-
C:\Users\Admin\AppData\Local\Temp\#README#.txtFilesize
2KB
MD5bb62ec7a63e5753ce7f6df005ed80c40
SHA12d22c38455a23a911e87f1c7eda6cf7f68396c67
SHA256b99b2de92232164524ace2b2bf3573351c65196572650902ea77b84c36310811
SHA51221a31235ecde657f9831d5d919168dcab45f041563a5f4e9978734f6a1c835488d1035bb989891f9f14ca7ee8468893af68cd5ace0bc0d4b12b2606e5409703e
-
memory/320-62-0x0000000000000000-mapping.dmp
-
memory/332-60-0x0000000000000000-mapping.dmp
-
memory/472-61-0x0000000000000000-mapping.dmp
-
memory/524-58-0x0000000000000000-mapping.dmp
-
memory/840-57-0x0000000000000000-mapping.dmp
-
memory/1112-59-0x0000000000000000-mapping.dmp
-
memory/1544-54-0x0000000001280000-0x0000000001296000-memory.dmpFilesize
88KB
-
memory/1544-56-0x00000000005E0000-0x00000000005E6000-memory.dmpFilesize
24KB
-
memory/1544-55-0x00000000002C0000-0x00000000002DC000-memory.dmpFilesize
112KB
-
memory/1744-66-0x0000000000000000-mapping.dmp
-
memory/1744-67-0x000007FEFBB71000-0x000007FEFBB73000-memory.dmpFilesize
8KB
-
memory/1912-63-0x0000000000000000-mapping.dmp
-
memory/1916-64-0x0000000000000000-mapping.dmp