Analysis
-
max time kernel
159s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 08:19
Static task
static1
Behavioral task
behavioral1
Sample
Yvbhq.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Yvbhq.exe
Resource
win10v2004-20220812-en
General
-
Target
Yvbhq.exe
-
Size
65KB
-
MD5
9829cba45d96db58f0898ad58743a474
-
SHA1
a3f4827d0523dac0c56e91b4538bdcf14c36570f
-
SHA256
19d2e3e1f912a1fe23399b0a1c150e28e03ef0cff5dfb7d2d532f705769862b5
-
SHA512
bd4d6431ca4315ad21a1094594ca0cb68a5cca689b64b73876045e468d1ba1c03d6845b444d2936ea50e71438b44ef65fdd74ca22d2339472f2f6e53be90cd8a
-
SSDEEP
1536:pmV+3Z/ZBJEomaAsurFk5ZjXx+plbfP9HPe0/v7WYPwoMkeT1eK6G:I+JtEomapYFk5ZsFP9HmelqT1N6G
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Yvbhq.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yvbhq = "C:\\Users\\Admin\\AppData\\Roaming\\HHN\\Yvbhq.exe" Yvbhq.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
Yvbhq.exedescription ioc process File opened for modification C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\desktop.ini Yvbhq.exe File opened for modification C:\Program Files\desktop.ini Yvbhq.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Yvbhq.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll Yvbhq.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jawt.h Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\net.properties Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml Yvbhq.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fil.pak Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\native2ascii.exe Yvbhq.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\youtube.crx Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\lcms.dll Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe Yvbhq.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\en-GB.pak Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\javafxpackager.exe Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\rt.jar Yvbhq.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\#README#.txt Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.properties Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.annotation_1.2.0.v201401042248.jar Yvbhq.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt Yvbhq.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\#README#.txt Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar Yvbhq.exe File opened for modification C:\Program Files\UseGet.scf Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll Yvbhq.exe File opened for modification C:\Program Files\Common Files\System\msadc\msdaprsr.dll Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_ja_4.4.0.v20140623020002.jar Yvbhq.exe File created C:\Program Files\Common Files\microsoft shared\ink\lt-LT\#README#.txt Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui Yvbhq.exe File created C:\Program Files\Common Files\microsoft shared\VC\#README#.txt Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.theme.nl_ja_4.4.0.v20140623020002.jar Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jli.dll Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\license.html Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml Yvbhq.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.text.nl_ja_4.4.0.v20140623020002.jar Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\nio.dll Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.nl_zh_4.4.0.v20140623020002.jar Yvbhq.exe File opened for modification C:\Program Files\Common Files\System\ado\msadox28.tlb Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.h Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jvmti.h Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll Yvbhq.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\#README#.txt Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.xml Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml Yvbhq.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml Yvbhq.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\#README#.txt Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\javafx-mx.jar Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_ja_4.4.0.v20140623020002.jar Yvbhq.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf Yvbhq.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 932 sc.exe -
Discovers systems in the same network 1 TTPs 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Yvbhq.exepid process 4612 Yvbhq.exe 4612 Yvbhq.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Yvbhq.exedescription pid process Token: SeDebugPrivilege 4612 Yvbhq.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Yvbhq.execmd.execmd.execmd.exedescription pid process target process PID 4612 wrote to memory of 952 4612 Yvbhq.exe cmd.exe PID 4612 wrote to memory of 952 4612 Yvbhq.exe cmd.exe PID 952 wrote to memory of 932 952 cmd.exe sc.exe PID 952 wrote to memory of 932 952 cmd.exe sc.exe PID 4612 wrote to memory of 3644 4612 Yvbhq.exe cmd.exe PID 4612 wrote to memory of 3644 4612 Yvbhq.exe cmd.exe PID 3644 wrote to memory of 4908 3644 cmd.exe net.exe PID 3644 wrote to memory of 4908 3644 cmd.exe net.exe PID 4612 wrote to memory of 3204 4612 Yvbhq.exe cmd.exe PID 4612 wrote to memory of 3204 4612 Yvbhq.exe cmd.exe PID 3204 wrote to memory of 2264 3204 cmd.exe net.exe PID 3204 wrote to memory of 2264 3204 cmd.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Yvbhq.exe"C:\Users\Admin\AppData\Local\Temp\Yvbhq.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C sc delete VSS2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc delete VSS3⤵
- Launches sc.exe
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C NET VIEW2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exeNET VIEW3⤵
- Discovers systems in the same network
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C NET USE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exeNET USE3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2891029575-1462575-1165213807-1000\desktop.iniFilesize
203B
MD51247a05311845ed4683182c6b3c7ad24
SHA1ce60f8bde7ba34d8099f2a484fceff6a7d067b1d
SHA25651587e2a4348fd17a92685998772a67af5a54e3e3fcc7706652fd30bee87b7d7
SHA512d437cca238996e46e85e8399fce1ef797d2a486ced01d0283f1343a81ad41727015bd54435b286e7911b3e668fc7798caec0d9bf6603e3661107c3c8d8d93fd5
-
memory/932-135-0x0000000000000000-mapping.dmp
-
memory/952-134-0x0000000000000000-mapping.dmp
-
memory/2264-140-0x0000000000000000-mapping.dmp
-
memory/3204-139-0x0000000000000000-mapping.dmp
-
memory/3644-136-0x0000000000000000-mapping.dmp
-
memory/4612-132-0x0000000000F10000-0x0000000000F26000-memory.dmpFilesize
88KB
-
memory/4612-133-0x00007FFFEE480000-0x00007FFFEEF41000-memory.dmpFilesize
10.8MB
-
memory/4612-138-0x00007FFFEE480000-0x00007FFFEEF41000-memory.dmpFilesize
10.8MB
-
memory/4908-137-0x0000000000000000-mapping.dmp