8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb

Analysis

max time kernel
151s
max time network
149s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 00:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe
Size

328KB
MD5

e447571b6cb8967e5428cbb7e07df9fc
SHA1

5ba72d05da0642577404d27d25007eadcedb059d
SHA256

8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb
SHA512

8d8aaf8521bc2be45012a5137f8f7fbde0b016741ad74f4665fb08a4aa03ba0fc25f858f5f1c240e450cea426fe0a0a3ee973ed71b18be28cba3de7e6338b3ca
SSDEEP

6144:iU83W+gY6Qkn2eCtN6mb4hZFlepVRzP/mHvAbR3TDOs5a3j:8mA6v5uQK4fFlepHTOAbtLa3j

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
892	ycweh.exe

Deletes itself 1 IoCs

pid	Process
696	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe
2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\{CB118568-7F59-AD4D-CD9C-5E5DE9C17D40} = "C:\\Users\\Admin\\AppData\\Roaming\\Uzzee\\ycweh.exe"	ycweh.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\Currentversion\Run	ycweh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2024 set thread context of 696	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	28

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Privacy	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe
892	ycweh.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe
892	ycweh.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 892	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	27
PID 2024 wrote to memory of 892	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	27
PID 2024 wrote to memory of 892	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	27
PID 2024 wrote to memory of 892	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	27
PID 892 wrote to memory of 1232	892	ycweh.exe	18
PID 892 wrote to memory of 1232	892	ycweh.exe	18
PID 892 wrote to memory of 1232	892	ycweh.exe	18
PID 892 wrote to memory of 1232	892	ycweh.exe	18
PID 892 wrote to memory of 1232	892	ycweh.exe	18
PID 892 wrote to memory of 1328	892	ycweh.exe	17
PID 892 wrote to memory of 1328	892	ycweh.exe	17
PID 892 wrote to memory of 1328	892	ycweh.exe	17
PID 892 wrote to memory of 1328	892	ycweh.exe	17
PID 892 wrote to memory of 1328	892	ycweh.exe	17
PID 892 wrote to memory of 1368	892	ycweh.exe	16
PID 892 wrote to memory of 1368	892	ycweh.exe	16
PID 892 wrote to memory of 1368	892	ycweh.exe	16
PID 892 wrote to memory of 1368	892	ycweh.exe	16
PID 892 wrote to memory of 1368	892	ycweh.exe	16
PID 892 wrote to memory of 2024	892	ycweh.exe	26
PID 892 wrote to memory of 2024	892	ycweh.exe	26
PID 892 wrote to memory of 2024	892	ycweh.exe	26
PID 892 wrote to memory of 2024	892	ycweh.exe	26
PID 892 wrote to memory of 2024	892	ycweh.exe	26
PID 2024 wrote to memory of 696	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	28
PID 2024 wrote to memory of 696	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	28
PID 2024 wrote to memory of 696	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	28
PID 2024 wrote to memory of 696	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	28
PID 2024 wrote to memory of 696	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	28
PID 2024 wrote to memory of 696	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	28
PID 2024 wrote to memory of 696	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	28
PID 2024 wrote to memory of 696	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	28
PID 2024 wrote to memory of 696	2024	8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe	28

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1368
- C:\Users\Admin\AppData\Local\Temp\8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe
  "C:\Users\Admin\AppData\Local\Temp\8675819c3e08fd71af709b5c0f3dd70dccb174bece846919ff5cef100bdf29cb.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious use of UnmapMainImage
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Users\Admin\AppData\Roaming\Uzzee\ycweh.exe
    "C:\Users\Admin\AppData\Roaming\Uzzee\ycweh.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of UnmapMainImage
    - Suspicious use of WriteProcessMemory
    PID:892
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpdab28c08.bat"
    3⤵
    - Deletes itself
    PID:696

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1328

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpdab28c08.bat

Filesize
307B

MD5
aeefccb9d3c31e9bd7c505f84fdb43d4

SHA1
24a623591634aa5b4d7ed4890c2c81e8ffd52d23

SHA256
fef869c3d9c442b648b0b3a7f84b3e4176048208058d06ec23a8006f73e2566c

SHA512
c13680520fd3fb4414c21692d5b55d0f722a0a48b3f30f0862ee74df2de60fbc39e38d4b2d58be62e385c041f13caf450eeeb97f2409b8bc3e2e3072bf599d37

Download Submit
C:\Users\Admin\AppData\Roaming\Uzzee\ycweh.exe

Filesize
328KB

MD5
2cbe865e5fd1f8eb1db339e10dc16624

SHA1
d86f820606a86b4e8c023d388564209a953dc0fe

SHA256
22913be58ae8a73c46cc495041e6511b112d0ef239ce489dc9cf1b12f66d2a6f

SHA512
71552cfbc91ebf35fbf2893def4eb97fd7849965148bf62986252abdd696c4b669f97b5c403b5df343f106ea01f646db703eaa2ac3344432adec402dc6f6074e

Download Submit
C:\Users\Admin\AppData\Roaming\Uzzee\ycweh.exe

Filesize
328KB

MD5
2cbe865e5fd1f8eb1db339e10dc16624

SHA1
d86f820606a86b4e8c023d388564209a953dc0fe

SHA256
22913be58ae8a73c46cc495041e6511b112d0ef239ce489dc9cf1b12f66d2a6f

SHA512
71552cfbc91ebf35fbf2893def4eb97fd7849965148bf62986252abdd696c4b669f97b5c403b5df343f106ea01f646db703eaa2ac3344432adec402dc6f6074e

Download Submit
\Users\Admin\AppData\Roaming\Uzzee\ycweh.exe

Filesize
328KB

MD5
2cbe865e5fd1f8eb1db339e10dc16624

SHA1
d86f820606a86b4e8c023d388564209a953dc0fe

SHA256
22913be58ae8a73c46cc495041e6511b112d0ef239ce489dc9cf1b12f66d2a6f

SHA512
71552cfbc91ebf35fbf2893def4eb97fd7849965148bf62986252abdd696c4b669f97b5c403b5df343f106ea01f646db703eaa2ac3344432adec402dc6f6074e

Download Submit
\Users\Admin\AppData\Roaming\Uzzee\ycweh.exe

Filesize
328KB

MD5
2cbe865e5fd1f8eb1db339e10dc16624

SHA1
d86f820606a86b4e8c023d388564209a953dc0fe

SHA256
22913be58ae8a73c46cc495041e6511b112d0ef239ce489dc9cf1b12f66d2a6f

SHA512
71552cfbc91ebf35fbf2893def4eb97fd7849965148bf62986252abdd696c4b669f97b5c403b5df343f106ea01f646db703eaa2ac3344432adec402dc6f6074e

Download Submit
memory/696-100-0x0000000000050000-0x0000000000094000-memory.dmp

Filesize
272KB

Download
memory/696-106-0x0000000000050000-0x0000000000094000-memory.dmp

Filesize
272KB

Download
memory/696-98-0x0000000000050000-0x0000000000094000-memory.dmp

Filesize
272KB

Download
memory/696-99-0x0000000000050000-0x0000000000094000-memory.dmp

Filesize
272KB

Download
memory/696-96-0x0000000000050000-0x0000000000094000-memory.dmp

Filesize
272KB

Download
memory/892-92-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/892-90-0x0000000000330000-0x0000000000374000-memory.dmp

Filesize
272KB

Download
memory/892-91-0x0000000000390000-0x00000000003E3000-memory.dmp

Filesize
332KB

Download
memory/1232-66-0x0000000001BE0000-0x0000000001C24000-memory.dmp

Filesize
272KB

Download
memory/1232-67-0x0000000001BE0000-0x0000000001C24000-memory.dmp

Filesize
272KB

Download
memory/1232-68-0x0000000001BE0000-0x0000000001C24000-memory.dmp

Filesize
272KB

Download
memory/1232-65-0x0000000001BE0000-0x0000000001C24000-memory.dmp

Filesize
272KB

Download
memory/1232-63-0x0000000001BE0000-0x0000000001C24000-memory.dmp

Filesize
272KB

Download
memory/1328-74-0x00000000002A0000-0x00000000002E4000-memory.dmp

Filesize
272KB

Download
memory/1328-73-0x00000000002A0000-0x00000000002E4000-memory.dmp

Filesize
272KB

Download
memory/1328-72-0x00000000002A0000-0x00000000002E4000-memory.dmp

Filesize
272KB

Download
memory/1328-71-0x00000000002A0000-0x00000000002E4000-memory.dmp

Filesize
272KB

Download
memory/1368-77-0x0000000002570000-0x00000000025B4000-memory.dmp

Filesize
272KB

Download
memory/1368-78-0x0000000002570000-0x00000000025B4000-memory.dmp

Filesize
272KB

Download
memory/1368-80-0x0000000002570000-0x00000000025B4000-memory.dmp

Filesize
272KB

Download
memory/1368-79-0x0000000002570000-0x00000000025B4000-memory.dmp

Filesize
272KB

Download
memory/2024-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/2024-84-0x00000000004F0000-0x0000000000534000-memory.dmp

Filesize
272KB

Download
memory/2024-89-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2024-88-0x00000000002D0000-0x0000000000323000-memory.dmp

Filesize
332KB

Download
memory/2024-83-0x00000000004F0000-0x0000000000534000-memory.dmp

Filesize
272KB

Download
memory/2024-87-0x0000000000280000-0x00000000002C4000-memory.dmp

Filesize
272KB

Download
memory/2024-85-0x00000000004F0000-0x0000000000534000-memory.dmp

Filesize
272KB

Download
memory/2024-93-0x00000000004F0000-0x0000000000543000-memory.dmp

Filesize
332KB

Download
memory/2024-86-0x00000000004F0000-0x0000000000534000-memory.dmp

Filesize
272KB

Download
memory/2024-103-0x00000000004F0000-0x0000000000534000-memory.dmp

Filesize
272KB

Download
memory/2024-102-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2024-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2024-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download