Analysis

  • max time kernel
    254s
  • max time network
    336s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 17:23

General

  • Target

    f646d1901a7f6c7d9abb558373309fa0067ca4080533b9530a72928ac362f1df.exe

  • Size

    256KB

  • MD5

    0d4cdf5cf99a75ac6d6393afc770e050

  • SHA1

    de9983f3caec9e298ca3d0c699aee80b93e19aa2

  • SHA256

    f646d1901a7f6c7d9abb558373309fa0067ca4080533b9530a72928ac362f1df

  • SHA512

    bfd8dbfff49b2f8b91a6aa61ce11d1b3476a0de7d0adc4bdfea07a6abefb5c8ab5d7e64c8437511f386279c39ce2d2c5573b94f2bcf1ae44a76bfd73d0fdee62

  • SSDEEP

    6144:ev7avoNymi+7eeyz2P9NnnnFCpImnTZygoHlKnvmb7/D26UBnmbLBXSG:eGvoNymi+7eOP9anTZygoHlKnvmb7/Dr

Score
10/10

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 45 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f646d1901a7f6c7d9abb558373309fa0067ca4080533b9530a72928ac362f1df.exe
    "C:\Users\Admin\AppData\Local\Temp\f646d1901a7f6c7d9abb558373309fa0067ca4080533b9530a72928ac362f1df.exe"
    1⤵
    • Modifies visiblity of hidden/system files in Explorer
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:512
    • C:\Users\Admin\yuiwia.exe
      "C:\Users\Admin\yuiwia.exe"
      2⤵
      • Modifies visiblity of hidden/system files in Explorer
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\yuiwia.exe

    Filesize

    256KB

    MD5

    dfc2e1572bfa06911b83c5854b20e5f7

    SHA1

    17908d7d70267bd551ed46d7ae3d02d4c1249239

    SHA256

    6c0209cf52b95cea2312b47c82232cbadf9293648278293f948a0647b66d3305

    SHA512

    9c53849c5e911c1796ea00bb21a4fa5716891e25fb01f7f8f50cfc9521ebc91652307c6ab7dd06793f569d0c37761bb1b355d77260f5d77ba7a6c2d9aaeaf0bf

  • C:\Users\Admin\yuiwia.exe

    Filesize

    256KB

    MD5

    dfc2e1572bfa06911b83c5854b20e5f7

    SHA1

    17908d7d70267bd551ed46d7ae3d02d4c1249239

    SHA256

    6c0209cf52b95cea2312b47c82232cbadf9293648278293f948a0647b66d3305

    SHA512

    9c53849c5e911c1796ea00bb21a4fa5716891e25fb01f7f8f50cfc9521ebc91652307c6ab7dd06793f569d0c37761bb1b355d77260f5d77ba7a6c2d9aaeaf0bf

  • \Users\Admin\yuiwia.exe

    Filesize

    256KB

    MD5

    dfc2e1572bfa06911b83c5854b20e5f7

    SHA1

    17908d7d70267bd551ed46d7ae3d02d4c1249239

    SHA256

    6c0209cf52b95cea2312b47c82232cbadf9293648278293f948a0647b66d3305

    SHA512

    9c53849c5e911c1796ea00bb21a4fa5716891e25fb01f7f8f50cfc9521ebc91652307c6ab7dd06793f569d0c37761bb1b355d77260f5d77ba7a6c2d9aaeaf0bf

  • \Users\Admin\yuiwia.exe

    Filesize

    256KB

    MD5

    dfc2e1572bfa06911b83c5854b20e5f7

    SHA1

    17908d7d70267bd551ed46d7ae3d02d4c1249239

    SHA256

    6c0209cf52b95cea2312b47c82232cbadf9293648278293f948a0647b66d3305

    SHA512

    9c53849c5e911c1796ea00bb21a4fa5716891e25fb01f7f8f50cfc9521ebc91652307c6ab7dd06793f569d0c37761bb1b355d77260f5d77ba7a6c2d9aaeaf0bf

  • memory/512-56-0x0000000075D51000-0x0000000075D53000-memory.dmp

    Filesize

    8KB