Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-01-2023 00:12
Static task
static1
Behavioral task
behavioral1
Sample
53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe
Resource
win10v2004-20221111-en
General
-
Target
53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe
-
Size
122KB
-
MD5
239ae44b1addd26c7a19e1abe92d9000
-
SHA1
b322da76f51ec9ce0c806ac0e43a9475e92e29ff
-
SHA256
53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db
-
SHA512
7bb6917aff1c4cef02b991d6c8b9c825c720f43c6d1872e51cb896f185b55368ade37f64448059456e58389db00ca9b2a27be4e649957dfa9258aa94f1a37ff0
-
SSDEEP
3072:8huoIU9PWr3pEnmGVk8jwaaHw7Koj4rDkISg2z:88jU9PWOOx7E
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\yijvttec\\hobietns.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
ytyggvpyjbnyddrx.exepid process 456 ytyggvpyjbnyddrx.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hobietns.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hobietns.exe svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exepid process 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\HobIetns = "C:\\Users\\Admin\\AppData\\Local\\yijvttec\\hobietns.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
svchost.exepid process 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe 1964 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 464 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exesvchost.exesvchost.exeytyggvpyjbnyddrx.exedescription pid process Token: SeSecurityPrivilege 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe Token: SeDebugPrivilege 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe Token: SeSecurityPrivilege 1168 svchost.exe Token: SeSecurityPrivilege 1964 svchost.exe Token: SeDebugPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeSecurityPrivilege 456 ytyggvpyjbnyddrx.exe Token: SeLoadDriverPrivilege 456 ytyggvpyjbnyddrx.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe Token: SeBackupPrivilege 1964 svchost.exe Token: SeRestorePrivilege 1964 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exedescription pid process target process PID 2032 wrote to memory of 1168 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1168 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1168 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1168 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1168 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1168 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1168 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1168 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1168 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1168 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1964 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1964 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1964 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1964 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1964 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1964 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1964 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1964 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1964 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 1964 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe svchost.exe PID 2032 wrote to memory of 456 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe ytyggvpyjbnyddrx.exe PID 2032 wrote to memory of 456 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe ytyggvpyjbnyddrx.exe PID 2032 wrote to memory of 456 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe ytyggvpyjbnyddrx.exe PID 2032 wrote to memory of 456 2032 53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe ytyggvpyjbnyddrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe"C:\Users\Admin\AppData\Local\Temp\53259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ytyggvpyjbnyddrx.exe"C:\Users\Admin\AppData\Local\Temp\ytyggvpyjbnyddrx.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ytyggvpyjbnyddrx.exeFilesize
122KB
MD5239ae44b1addd26c7a19e1abe92d9000
SHA1b322da76f51ec9ce0c806ac0e43a9475e92e29ff
SHA25653259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db
SHA5127bb6917aff1c4cef02b991d6c8b9c825c720f43c6d1872e51cb896f185b55368ade37f64448059456e58389db00ca9b2a27be4e649957dfa9258aa94f1a37ff0
-
C:\Users\Admin\AppData\Local\Temp\ytyggvpyjbnyddrx.exeFilesize
122KB
MD5239ae44b1addd26c7a19e1abe92d9000
SHA1b322da76f51ec9ce0c806ac0e43a9475e92e29ff
SHA25653259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db
SHA5127bb6917aff1c4cef02b991d6c8b9c825c720f43c6d1872e51cb896f185b55368ade37f64448059456e58389db00ca9b2a27be4e649957dfa9258aa94f1a37ff0
-
\Users\Admin\AppData\Local\Temp\ytyggvpyjbnyddrx.exeFilesize
122KB
MD5239ae44b1addd26c7a19e1abe92d9000
SHA1b322da76f51ec9ce0c806ac0e43a9475e92e29ff
SHA25653259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db
SHA5127bb6917aff1c4cef02b991d6c8b9c825c720f43c6d1872e51cb896f185b55368ade37f64448059456e58389db00ca9b2a27be4e649957dfa9258aa94f1a37ff0
-
\Users\Admin\AppData\Local\Temp\ytyggvpyjbnyddrx.exeFilesize
122KB
MD5239ae44b1addd26c7a19e1abe92d9000
SHA1b322da76f51ec9ce0c806ac0e43a9475e92e29ff
SHA25653259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db
SHA5127bb6917aff1c4cef02b991d6c8b9c825c720f43c6d1872e51cb896f185b55368ade37f64448059456e58389db00ca9b2a27be4e649957dfa9258aa94f1a37ff0
-
\Users\Admin\AppData\Local\Temp\ytyggvpyjbnyddrx.exeFilesize
122KB
MD5239ae44b1addd26c7a19e1abe92d9000
SHA1b322da76f51ec9ce0c806ac0e43a9475e92e29ff
SHA25653259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db
SHA5127bb6917aff1c4cef02b991d6c8b9c825c720f43c6d1872e51cb896f185b55368ade37f64448059456e58389db00ca9b2a27be4e649957dfa9258aa94f1a37ff0
-
\Users\Admin\AppData\Local\Temp\ytyggvpyjbnyddrx.exeFilesize
122KB
MD5239ae44b1addd26c7a19e1abe92d9000
SHA1b322da76f51ec9ce0c806ac0e43a9475e92e29ff
SHA25653259b37c3a8c0491cf484b4fc86116052937b2bbec39d9673e46b7f7ca701db
SHA5127bb6917aff1c4cef02b991d6c8b9c825c720f43c6d1872e51cb896f185b55368ade37f64448059456e58389db00ca9b2a27be4e649957dfa9258aa94f1a37ff0
-
memory/456-78-0x0000000000000000-mapping.dmp
-
memory/456-82-0x0000000000400000-0x0000000000432144-memory.dmpFilesize
200KB
-
memory/1168-59-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1168-58-0x0000000000000000-mapping.dmp
-
memory/1168-56-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1964-69-0x0000000020010000-0x0000000020024000-memory.dmpFilesize
80KB
-
memory/1964-67-0x0000000000000000-mapping.dmp
-
memory/1964-65-0x0000000020010000-0x0000000020024000-memory.dmpFilesize
80KB
-
memory/2032-73-0x0000000000400000-0x0000000000432144-memory.dmpFilesize
200KB
-
memory/2032-54-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB