Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 19:42
Static task
static1
Behavioral task
behavioral1
Sample
efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe
-
Size
156KB
-
MD5
03d69d0fe666b64a2679926a6a6bb3fc
-
SHA1
7c459c7d62cde296592a22e424a18818e1d5fbf9
-
SHA256
efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b
-
SHA512
fe28398484647cdb282595017961c022888ab982a2d4a4d77c83f51d2ecb70645cd69f3a9ad63d0152224a20ca1b4503dbe0fdf3d329dda392058df0e59b6f4a
-
SSDEEP
3072:QBd16E2MtU7Qv0w4ZRRQMMDwtIMCeFP4ANA4oQZiEp9E/X:SdIE2R7Qvb4tQTaCeFP4A+Wv90
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yoadua.exe -
Executes dropped EXE 1 IoCs
pid Process 1124 yoadua.exe -
Loads dropped DLL 2 IoCs
pid Process 1208 efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe 1208 efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /d" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /u" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /f" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /O" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /C" yoadua.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /Y" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /i" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /B" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /v" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /a" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /L" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /l" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /D" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /w" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /s" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /W" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /G" yoadua.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /K" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /R" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /J" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /z" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /T" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /b" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /S" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /e" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /d" efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /m" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /P" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /o" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /U" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /n" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /y" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /Q" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /g" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /V" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /r" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /Z" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /F" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /c" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /H" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /X" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /q" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /k" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /x" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /h" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /M" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /j" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /A" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /I" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /t" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /N" yoadua.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoadua = "C:\\Users\\Admin\\yoadua.exe /E" yoadua.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1208 efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe 1124 yoadua.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1208 efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe 1124 yoadua.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1208 wrote to memory of 1124 1208 efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe 27 PID 1208 wrote to memory of 1124 1208 efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe 27 PID 1208 wrote to memory of 1124 1208 efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe 27 PID 1208 wrote to memory of 1124 1208 efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe"C:\Users\Admin\AppData\Local\Temp\efdfbbee379727514f0b087e5aa00eecfddd5c1c1b67cd5062485a2970a9051b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\yoadua.exe"C:\Users\Admin\yoadua.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1124
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156KB
MD5eedb14cc9af2002ba4cdea9fae417835
SHA1dbdc7a1805529b2231c3fdfc83d6b82cb1b8e4c1
SHA25609a64382d0a44c4dced35be97e3a9679b1e92eb4c3361d6fa2ae6c8574ad9019
SHA51297aaaf7e9fd1bc5104172337fb507239df003333fae811f9a36666cff7696bbe2ca7edf06c6ae214b6765c9d5728aafc038525b65edf91417489936922d0dd12
-
Filesize
156KB
MD5eedb14cc9af2002ba4cdea9fae417835
SHA1dbdc7a1805529b2231c3fdfc83d6b82cb1b8e4c1
SHA25609a64382d0a44c4dced35be97e3a9679b1e92eb4c3361d6fa2ae6c8574ad9019
SHA51297aaaf7e9fd1bc5104172337fb507239df003333fae811f9a36666cff7696bbe2ca7edf06c6ae214b6765c9d5728aafc038525b65edf91417489936922d0dd12
-
Filesize
156KB
MD5eedb14cc9af2002ba4cdea9fae417835
SHA1dbdc7a1805529b2231c3fdfc83d6b82cb1b8e4c1
SHA25609a64382d0a44c4dced35be97e3a9679b1e92eb4c3361d6fa2ae6c8574ad9019
SHA51297aaaf7e9fd1bc5104172337fb507239df003333fae811f9a36666cff7696bbe2ca7edf06c6ae214b6765c9d5728aafc038525b65edf91417489936922d0dd12
-
Filesize
156KB
MD5eedb14cc9af2002ba4cdea9fae417835
SHA1dbdc7a1805529b2231c3fdfc83d6b82cb1b8e4c1
SHA25609a64382d0a44c4dced35be97e3a9679b1e92eb4c3361d6fa2ae6c8574ad9019
SHA51297aaaf7e9fd1bc5104172337fb507239df003333fae811f9a36666cff7696bbe2ca7edf06c6ae214b6765c9d5728aafc038525b65edf91417489936922d0dd12