13e7f4b66b74a37a78fae79a7d4a0267efb42d622d7a0a883ff7990fc4448613

General

Target

449db7ead280736b0e7610b2a7a84e5c.exe
Size

332KB
MD5

449db7ead280736b0e7610b2a7a84e5c
SHA1

cb2fef6c9eda407dec841e107315e09e25ef21bb
SHA256

13e7f4b66b74a37a78fae79a7d4a0267efb42d622d7a0a883ff7990fc4448613
SHA512

ea4a8f5bc3c1a06c70c888014bfc5d42c6b26ecff99ad951f513890c0474651e7af759a3740a85ffdf6121307d8aacf63c90eced14e0858636bf5ca5812c9da1
SSDEEP

3072:7q9jSeaNxnuD7mEVSuekhGkYrQRVZq3eFo4ejLnlQISQLpyhZu6qyKtrlbHrs2OI:L5NxM2WGk1Y3nmQcuyKdFrs2OXuHNz

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dyyauk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	449db7ead280736b0e7610b2a7a84e5c.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	449db7ead280736b0e7610b2a7a84e5c.exe

Executes dropped EXE 1 IoCs

pid	Process
540	dyyauk.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /j"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /y"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /p"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /d"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /t"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /z"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /c"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /n"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /o"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /v"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /m"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /g"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /c"	449db7ead280736b0e7610b2a7a84e5c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /a"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /x"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /l"	dyyauk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dyyauk = "C:\\Users\\Admin\\dyyauk.exe /w"	dyyauk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
2084	449db7ead280736b0e7610b2a7a84e5c.exe
2084	449db7ead280736b0e7610b2a7a84e5c.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe
540	dyyauk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2084	449db7ead280736b0e7610b2a7a84e5c.exe
540	dyyauk.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 540	2084	449db7ead280736b0e7610b2a7a84e5c.exe	99
PID 2084 wrote to memory of 540	2084	449db7ead280736b0e7610b2a7a84e5c.exe	99
PID 2084 wrote to memory of 540	2084	449db7ead280736b0e7610b2a7a84e5c.exe	99

C:\Users\Admin\AppData\Local\Temp\449db7ead280736b0e7610b2a7a84e5c.exe
"C:\Users\Admin\AppData\Local\Temp\449db7ead280736b0e7610b2a7a84e5c.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\dyyauk.exe
  "C:\Users\Admin\dyyauk.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\dyyauk.exe

Filesize
332KB

MD5
91e36bb5bf667b77a6ca8aab0cdfd7ba

SHA1
4cba9890b56836d055e74afcb9740eb7ef594e37

SHA256
ec83c0e29ddbe63255f27f83af64d4826704bd4462b0a93cf1746f830d2614ab

SHA512
f3aba2dd2dae25de76ed4250b5d09391843ef4503d94f68e39990174a2265468e5d833ea23bf1b977204adc0499ef0e1e1f9e0d628ff4888d1d0a36258e0a508

Download Submit
C:\Users\Admin\dyyauk.exe

Filesize
292KB

MD5
6281c74f2c34fc01ca8361f86e1cfb83

SHA1
03ff6fdf27d1de7abe5d8dbbefdfc22b6ee81119

SHA256
866e5439b10deeb8f84888af86704a76233e00e8a3d0a17b15f8b52f7c0d9f9e

SHA512
d423de72a7ab1ec9d3a9975b92be7d8a24355c5ee194eb4d41c55da7395d6b5af1fd8a2d8574de7a32c0189b4cea4da5cf186e446a1777fe508e7807482dbb7e

Download Submit
C:\Users\Admin\dyyauk.exe

Filesize
41KB

MD5
7a54a93d29d3421b43dbd1801d4e2032

SHA1
8bbbbeaf95fa0159b222bd545cca0e0a2fac64ba

SHA256
9a4db88af9106babaadba7432df6e9d6418e59bd38a7a35f08cadd36ac6c3a12

SHA512
c13ef8242a496991b0e6ef588d2f0661cc3ce7947df35e38d124c9593ab3191abf4174b87b92159653f1030e2029e6f4a9847190a4946bda1d0f5973f297e231

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads