Analysis
-
max time kernel
150s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 23:35
Static task
static1
Behavioral task
behavioral1
Sample
a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe
-
Size
224KB
-
MD5
89630b0c79e5b8a352a8e4f334a5f6db
-
SHA1
5b102da558ffa8f554a056ad83ad451faa5d036c
-
SHA256
a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823
-
SHA512
95dca77ad0f6ba6080d23bc01dc5968384c6da717edbae873c2ca22c146465d82a58d65f5636e4421a888d812d23bd2f5a2093afb525f7e7b389b0a07cc5541d
-
SSDEEP
6144:2m7oqr3iNvcMI55xjg4+tU1pZ5UdxIOTQMyHct1FHRQoG2:R7oQMULfjg4+tU1pZ5UdxIOTQMyHS1Fv
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yiejel.exe -
Executes dropped EXE 1 IoCs
pid Process 968 yiejel.exe -
Loads dropped DLL 2 IoCs
pid Process 360 a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe 360 a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /f" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /q" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /P" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /S" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /I" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /T" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /h" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /D" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /W" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /J" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /e" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /p" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /Q" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /d" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /B" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /z" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /m" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /C" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /Y" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /E" yiejel.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /L" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /j" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /i" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /G" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /O" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /K" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /v" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /t" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /y" a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /u" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /N" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /w" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /U" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /X" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /b" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /o" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /k" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /H" yiejel.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /Z" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /n" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /l" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /A" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /r" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /V" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /F" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /s" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /g" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /x" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /c" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /M" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /y" yiejel.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\yiejel = "C:\\Users\\Admin\\yiejel.exe /R" yiejel.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 360 a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe 968 yiejel.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 360 a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe 968 yiejel.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 360 wrote to memory of 968 360 a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe 27 PID 360 wrote to memory of 968 360 a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe 27 PID 360 wrote to memory of 968 360 a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe 27 PID 360 wrote to memory of 968 360 a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe"C:\Users\Admin\AppData\Local\Temp\a9ba07c866f44aed21e556a48408ad2474929ef9316981480ced319f3ef97823.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\yiejel.exe"C:\Users\Admin\yiejel.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:968
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5374f2d0b3c6d62ee188c14a611bc128f
SHA1de901f3e97dd0232a6f1d2154ca6db4c91f4c43b
SHA2566fb61d10108a02b9d82eecceaa44e45fd46d6b0179a0dafe13c112814634c410
SHA512246287893fbe2b8ee6742ecda9423ce5965ecea330a148d08c15c00bf4c7b0180ccfbbb6f878035c6e56cfd86284dfa2995d3a6c70f727dd38d330cccc70fb84
-
Filesize
224KB
MD5374f2d0b3c6d62ee188c14a611bc128f
SHA1de901f3e97dd0232a6f1d2154ca6db4c91f4c43b
SHA2566fb61d10108a02b9d82eecceaa44e45fd46d6b0179a0dafe13c112814634c410
SHA512246287893fbe2b8ee6742ecda9423ce5965ecea330a148d08c15c00bf4c7b0180ccfbbb6f878035c6e56cfd86284dfa2995d3a6c70f727dd38d330cccc70fb84
-
Filesize
224KB
MD5374f2d0b3c6d62ee188c14a611bc128f
SHA1de901f3e97dd0232a6f1d2154ca6db4c91f4c43b
SHA2566fb61d10108a02b9d82eecceaa44e45fd46d6b0179a0dafe13c112814634c410
SHA512246287893fbe2b8ee6742ecda9423ce5965ecea330a148d08c15c00bf4c7b0180ccfbbb6f878035c6e56cfd86284dfa2995d3a6c70f727dd38d330cccc70fb84
-
Filesize
224KB
MD5374f2d0b3c6d62ee188c14a611bc128f
SHA1de901f3e97dd0232a6f1d2154ca6db4c91f4c43b
SHA2566fb61d10108a02b9d82eecceaa44e45fd46d6b0179a0dafe13c112814634c410
SHA512246287893fbe2b8ee6742ecda9423ce5965ecea330a148d08c15c00bf4c7b0180ccfbbb6f878035c6e56cfd86284dfa2995d3a6c70f727dd38d330cccc70fb84