fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526

Resubmissions

10/01/2023, 13:24

230110-qnqr7agb59 8

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
10/01/2023, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526.exe
Size

31.1MB
MD5

10a910afb65fec46d9beb34dff8ab769
SHA1

9e67ec999dbb2c8f314ad566ec048ab261ddae14
SHA256

fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526
SHA512

04aed0110eac40f5af4191f92fdd1dc56a59ebe60d34be22cba36653766a408bb3abf14e00066d569b6f3fe76656f7515e6844a5db5c133d8ee60b812c37b6ed
SSDEEP

786432:GYC3dIangzjM6+ZCey4wln+eXRUZiEMqncbRfhT4rnzKO7+24RbzIkx3KhkGo9So:G1iangzjj+oey4wogEMccbRJsTuwR4Rr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
972	ykyc.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\__tmp_rar_sfx_access_check_7080120	ykyc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ykyc.vbs	ykyc.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ykyc.vbs	ykyc.exe

Loads dropped DLL 3 IoCs

pid	Process
1528	fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526.exe
1528	fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526.exe
1528	fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 972	1528	fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526.exe	28
PID 1528 wrote to memory of 972	1528	fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526.exe	28
PID 1528 wrote to memory of 972	1528	fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526.exe	28
PID 1528 wrote to memory of 972	1528	fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526.exe	28

C:\Users\Admin\AppData\Local\Temp\fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526.exe
"C:\Users\Admin\AppData\Local\Temp\fa78bc9344b455597d4b22d4424125b13b9a5d803e2dad383ffc016932017526.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\ykyc.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ykyc.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  PID:972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\ykyc.exe

Filesize
307KB

MD5
b546ba1065537a2389cd0a6b61d84878

SHA1
35c0d61349690d751a1167cda5f7302742589f4e

SHA256
42e240f28cd0b339ee8f96d2ee490d6661f8ba1fd084c528589d1c9e224bac3b

SHA512
ea918609236e7f8a95cdb83f2125ba4ff8fbf9469730f2ddec30bc04ca0dcae196fafc051aa6a4dcd2e79efe6b4c21c717919fcfb9bdf1408621dde80aeea3f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ykyc.exe

Filesize
307KB

MD5
b546ba1065537a2389cd0a6b61d84878

SHA1
35c0d61349690d751a1167cda5f7302742589f4e

SHA256
42e240f28cd0b339ee8f96d2ee490d6661f8ba1fd084c528589d1c9e224bac3b

SHA512
ea918609236e7f8a95cdb83f2125ba4ff8fbf9469730f2ddec30bc04ca0dcae196fafc051aa6a4dcd2e79efe6b4c21c717919fcfb9bdf1408621dde80aeea3f4

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ykyc.exe

Filesize
307KB

MD5
b546ba1065537a2389cd0a6b61d84878

SHA1
35c0d61349690d751a1167cda5f7302742589f4e

SHA256
42e240f28cd0b339ee8f96d2ee490d6661f8ba1fd084c528589d1c9e224bac3b

SHA512
ea918609236e7f8a95cdb83f2125ba4ff8fbf9469730f2ddec30bc04ca0dcae196fafc051aa6a4dcd2e79efe6b4c21c717919fcfb9bdf1408621dde80aeea3f4

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ykyc.exe

Filesize
307KB

MD5
b546ba1065537a2389cd0a6b61d84878

SHA1
35c0d61349690d751a1167cda5f7302742589f4e

SHA256
42e240f28cd0b339ee8f96d2ee490d6661f8ba1fd084c528589d1c9e224bac3b

SHA512
ea918609236e7f8a95cdb83f2125ba4ff8fbf9469730f2ddec30bc04ca0dcae196fafc051aa6a4dcd2e79efe6b4c21c717919fcfb9bdf1408621dde80aeea3f4

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\ykyc.exe

Filesize
307KB

MD5
b546ba1065537a2389cd0a6b61d84878

SHA1
35c0d61349690d751a1167cda5f7302742589f4e

SHA256
42e240f28cd0b339ee8f96d2ee490d6661f8ba1fd084c528589d1c9e224bac3b

SHA512
ea918609236e7f8a95cdb83f2125ba4ff8fbf9469730f2ddec30bc04ca0dcae196fafc051aa6a4dcd2e79efe6b4c21c717919fcfb9bdf1408621dde80aeea3f4

Download Submit
memory/1528-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download