Analysis

  • max time kernel
    150s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/12/2022, 00:26

General

  • Target

    982c9b4433a74a177275185249438ced101a086e58dc13c80f196f3dd8a27765.exe

  • Size

    200KB

  • MD5

    670e7ba325b462f960cd0f5b56354916

  • SHA1

    0e3287287e39fa0c570204599bc37269419518aa

  • SHA256

    982c9b4433a74a177275185249438ced101a086e58dc13c80f196f3dd8a27765

  • SHA512

    d9d25506072fc6323d719c9863b0755c90571411f3b76f8ae890be8ddb9b30a6c827330d157a60cd66a1b713ddf033651e5c48af83fcbae00da38659af667593

  • SSDEEP

    3072:CLv6LHJdkvY2+ydeYMvnWtmpzaVmS4plDuUhMjn:ovadkgM03utmQt4n7+

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 29 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\982c9b4433a74a177275185249438ced101a086e58dc13c80f196f3dd8a27765.exe
    "C:\Users\Admin\AppData\Local\Temp\982c9b4433a74a177275185249438ced101a086e58dc13c80f196f3dd8a27765.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\yoikuo.exe
      "C:\Users\Admin\yoikuo.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1348

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\yoikuo.exe

    Filesize

    200KB

    MD5

    53d79feccb3cc4823ca4df9f9b913cb8

    SHA1

    7d6e3a8992afc247e54120caaec2a639a88678e5

    SHA256

    88f923ac89ad87c7d2dda43ecb97c022e461ca61b2e564d8018e44fea443744d

    SHA512

    383a1acd1c62ad274f640ce3ac5eadf43affcfbfd983888aebca2732a6181df784a165d1d203373476cbf6f310d6117af6aa00aaf4365a362824c1a935b14c81

  • C:\Users\Admin\yoikuo.exe

    Filesize

    200KB

    MD5

    53d79feccb3cc4823ca4df9f9b913cb8

    SHA1

    7d6e3a8992afc247e54120caaec2a639a88678e5

    SHA256

    88f923ac89ad87c7d2dda43ecb97c022e461ca61b2e564d8018e44fea443744d

    SHA512

    383a1acd1c62ad274f640ce3ac5eadf43affcfbfd983888aebca2732a6181df784a165d1d203373476cbf6f310d6117af6aa00aaf4365a362824c1a935b14c81

  • \Users\Admin\yoikuo.exe

    Filesize

    200KB

    MD5

    53d79feccb3cc4823ca4df9f9b913cb8

    SHA1

    7d6e3a8992afc247e54120caaec2a639a88678e5

    SHA256

    88f923ac89ad87c7d2dda43ecb97c022e461ca61b2e564d8018e44fea443744d

    SHA512

    383a1acd1c62ad274f640ce3ac5eadf43affcfbfd983888aebca2732a6181df784a165d1d203373476cbf6f310d6117af6aa00aaf4365a362824c1a935b14c81

  • \Users\Admin\yoikuo.exe

    Filesize

    200KB

    MD5

    53d79feccb3cc4823ca4df9f9b913cb8

    SHA1

    7d6e3a8992afc247e54120caaec2a639a88678e5

    SHA256

    88f923ac89ad87c7d2dda43ecb97c022e461ca61b2e564d8018e44fea443744d

    SHA512

    383a1acd1c62ad274f640ce3ac5eadf43affcfbfd983888aebca2732a6181df784a165d1d203373476cbf6f310d6117af6aa00aaf4365a362824c1a935b14c81

  • memory/1348-66-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1348-69-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1668-56-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1668-57-0x0000000075071000-0x0000000075073000-memory.dmp

    Filesize

    8KB

  • memory/1668-65-0x0000000002E40000-0x0000000002E7C000-memory.dmp

    Filesize

    240KB

  • memory/1668-68-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB