7ec3a4a7872f40773186d53eeba2352c498ee3178104359638abb3a4c7578800

Analysis

max time kernel
16s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1631fd1307d62dffa2fc5c238f5630c8.exe
Size

250KB
MD5

1631fd1307d62dffa2fc5c238f5630c8
SHA1

47566b36258b6ad7e08b5c8cfb7cd9eeb4b063e1
SHA256

7ec3a4a7872f40773186d53eeba2352c498ee3178104359638abb3a4c7578800
SHA512

e6f2341d2fd34ace68bc64a91c7b96bd8cf482bd1f4faee2904a90ed70927d3eb8d286b70b52fd99bf19ce71613fd56102df94338d57f9af247e501556713489
SSDEEP

6144:wciEde2K/IyHwihFp7non6Y/PUaKwtapzVmS5nJfcQ/4hz9Vm6Reqhj7D:bF/K/IyHpb4m3UQWz9Vvn

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2180	sfx.exe
2788	input.exe
2644	ytosi.exe

Loads dropped DLL 9 IoCs

pid	Process
2176	WScript.exe
2180	sfx.exe
2180	sfx.exe
2180	sfx.exe
2180	sfx.exe
2788	input.exe
2788	input.exe
2644	ytosi.exe
2644	ytosi.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ovxyywtifi = "C:\\Users\\Admin\\AppData\\Roaming\\Cumax\\ytosi.exe"	ytosi.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2788 set thread context of 2584	2788	input.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Privacy	sfx.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	sfx.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\45033E42-00000001.eml:OECustomProperty	WinMail.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2644	ytosi.exe
2644	ytosi.exe
2644	ytosi.exe
2644	ytosi.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2788	input.exe
Token: SeSecurityPrivilege	2788	input.exe
Token: SeSecurityPrivilege	2180	sfx.exe
Token: SeSecurityPrivilege	2180	sfx.exe
Token: SeSecurityPrivilege	2180	sfx.exe
Token: SeSecurityPrivilege	2180	sfx.exe
Token: SeSecurityPrivilege	2180	sfx.exe
Token: SeSecurityPrivilege	2180	sfx.exe
Token: SeSecurityPrivilege	2180	sfx.exe
Token: SeSecurityPrivilege	2180	sfx.exe
Token: SeManageVolumePrivilege	1604	WinMail.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1604	WinMail.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1604	WinMail.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1604	WinMail.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2176	1972	1631fd1307d62dffa2fc5c238f5630c8.exe	17
PID 1972 wrote to memory of 2176	1972	1631fd1307d62dffa2fc5c238f5630c8.exe	17
PID 1972 wrote to memory of 2176	1972	1631fd1307d62dffa2fc5c238f5630c8.exe	17
PID 1972 wrote to memory of 2176	1972	1631fd1307d62dffa2fc5c238f5630c8.exe	17
PID 2176 wrote to memory of 2180	2176	WScript.exe	18
PID 2176 wrote to memory of 2180	2176	WScript.exe	18
PID 2176 wrote to memory of 2180	2176	WScript.exe	18
PID 2176 wrote to memory of 2180	2176	WScript.exe	18
PID 2176 wrote to memory of 2180	2176	WScript.exe	18
PID 2176 wrote to memory of 2180	2176	WScript.exe	18
PID 2176 wrote to memory of 2180	2176	WScript.exe	18
PID 2180 wrote to memory of 2788	2180	sfx.exe	23
PID 2180 wrote to memory of 2788	2180	sfx.exe	23
PID 2180 wrote to memory of 2788	2180	sfx.exe	23
PID 2180 wrote to memory of 2788	2180	sfx.exe	23
PID 2180 wrote to memory of 2788	2180	sfx.exe	23
PID 2180 wrote to memory of 2788	2180	sfx.exe	23
PID 2180 wrote to memory of 2788	2180	sfx.exe	23
PID 2788 wrote to memory of 2644	2788	input.exe	28
PID 2788 wrote to memory of 2644	2788	input.exe	28
PID 2788 wrote to memory of 2644	2788	input.exe	28
PID 2788 wrote to memory of 2644	2788	input.exe	28
PID 2788 wrote to memory of 2644	2788	input.exe	28
PID 2788 wrote to memory of 2644	2788	input.exe	28
PID 2788 wrote to memory of 2644	2788	input.exe	28
PID 2644 wrote to memory of 1252	2644	ytosi.exe	13
PID 2644 wrote to memory of 1252	2644	ytosi.exe	13
PID 2644 wrote to memory of 1252	2644	ytosi.exe	13
PID 2644 wrote to memory of 1252	2644	ytosi.exe	13
PID 2644 wrote to memory of 1252	2644	ytosi.exe	13
PID 2644 wrote to memory of 1336	2644	ytosi.exe	12
PID 2644 wrote to memory of 1336	2644	ytosi.exe	12
PID 2644 wrote to memory of 1336	2644	ytosi.exe	12
PID 2644 wrote to memory of 1336	2644	ytosi.exe	12
PID 2644 wrote to memory of 1336	2644	ytosi.exe	12
PID 2644 wrote to memory of 1376	2644	ytosi.exe	11
PID 2644 wrote to memory of 1376	2644	ytosi.exe	11
PID 2644 wrote to memory of 1376	2644	ytosi.exe	11
PID 2644 wrote to memory of 1376	2644	ytosi.exe	11
PID 2644 wrote to memory of 1376	2644	ytosi.exe	11
PID 2644 wrote to memory of 1488	2644	ytosi.exe	6
PID 2644 wrote to memory of 1488	2644	ytosi.exe	6
PID 2644 wrote to memory of 1488	2644	ytosi.exe	6
PID 2644 wrote to memory of 1488	2644	ytosi.exe	6
PID 2644 wrote to memory of 1488	2644	ytosi.exe	6
PID 2644 wrote to memory of 2180	2644	ytosi.exe	18
PID 2644 wrote to memory of 2180	2644	ytosi.exe	18
PID 2644 wrote to memory of 2180	2644	ytosi.exe	18
PID 2644 wrote to memory of 2180	2644	ytosi.exe	18
PID 2644 wrote to memory of 2180	2644	ytosi.exe	18
PID 2644 wrote to memory of 2788	2644	ytosi.exe	23
PID 2644 wrote to memory of 2788	2644	ytosi.exe	23
PID 2644 wrote to memory of 2788	2644	ytosi.exe	23
PID 2644 wrote to memory of 2788	2644	ytosi.exe	23
PID 2644 wrote to memory of 2788	2644	ytosi.exe	23
PID 2788 wrote to memory of 2584	2788	input.exe	35
PID 2788 wrote to memory of 2584	2788	input.exe	35
PID 2788 wrote to memory of 2584	2788	input.exe	35
PID 2788 wrote to memory of 2584	2788	input.exe	35
PID 2788 wrote to memory of 2584	2788	input.exe	35
PID 2788 wrote to memory of 2584	2788	input.exe	35
PID 2788 wrote to memory of 2584	2788	input.exe	35
PID 2788 wrote to memory of 2584	2788	input.exe	35
PID 2788 wrote to memory of 2584	2788	input.exe	35

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1488

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1376
- C:\Users\Admin\AppData\Local\Temp\1631fd1307d62dffa2fc5c238f5630c8.exe
  "C:\Users\Admin\AppData\Local\Temp\1631fd1307d62dffa2fc5c238f5630c8.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\stub.vbs"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sfx.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sfx.exe" -p456jh34k5h6bj4563j456j3456jjj45jjj
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies Internet Explorer settings
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\input.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\input.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2788
      - C:\Users\Admin\AppData\Roaming\Cumax\ytosi.exe
        
        "C:\Users\Admin\AppData\Roaming\Cumax\ytosi.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2644
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5b6412cc.bat"
        6⤵
        
        PID:2584

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1336

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1252

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1604

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "5199182524831246113209405351800321467-36422714418249882819708225941454827285"
1⤵
PID:2592

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1524

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sfx.exe

Filesize
96KB

MD5
e604dd6ee29e8d6b44dd59da98c366f8

SHA1
6691eeff79e009986430980a5a8387604b122b69

SHA256
7b994e2a623f229de9f2a32ccdf7fe68b9873c11a561d9fbc349d28e5c401eca

SHA512
a77636bf13fa9bb96a4dd393bc730e26a84f25381c627e7723b87e30e99d7cad8fa5b7a174435b06c78cb50ebb2edac949bf868c70551ce12eeec1130c074f6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\stub.vbs

Filesize
132B

MD5
826c3dfb5d027b8a9c9ddbd74216f9b4

SHA1
c0a1efd6d81b81dbf21c33464edc885e54404226

SHA256
7ac2d95d5b2d56142c35b51690f50d211af96797795d00ba2fd7d65bc12a71b2

SHA512
f66f948c519c956aaf57a53cad09247af267fa644fae500567380acb7f438abacd70cc9dc8c340b972aca0e56d48bc67134ff9118e3463e84ea2859334d6ae67

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\input.exe

Filesize
212KB

MD5
851b984fbd8967a644ef367087a6328d

SHA1
dcaf74e9bceac1bb1e3d9959907093f06e17fdbf

SHA256
99ba4621d0286e835238810bcd80055fa72f189db3459c072f4a23d5a0b135ff

SHA512
6fc2b1ec9c3805d6cabf665122c7a704086ac467a02c1fa6f7741e3e1a31b8fbb44ac85a4835a5a3c6c022ae83c05a92545141886f05bbfbdf441448b8b58f9b

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sfx.exe

Filesize
209KB

MD5
e426a3ed568d303211945f0d005346a0

SHA1
86271a7e27e291260687291a12b3756e702835b0

SHA256
23600ab6542b70ea5aab1b367f5793832a9ac7bc5e3477f7e20a0cb70644d21f

SHA512
a9568edef1f0b46f34903d56ecb494001ecb7138279314fecd639ad109379f019a0a59b0b18657e315a4f6c07509dda80827bc445bc44b4150a541822e86cf1e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\input.exe

Filesize
92KB

MD5
ecd1dba159bef17eccf0bff58f9540df

SHA1
67a8f2cf28fff51eb43098c2c8d49fb3942aec92

SHA256
86cad6b65556bd5f762ecf87d2fc73fe1d6d193f34a6f45bee7d02f2fe4cd91b

SHA512
d33803173d6d4138ef95f1f077172f8cb30670022526e708ce8171a2c625d718d285b9ea05a9bd7d89a782862663a143fc43a1d4d9b4a6744cd6e9fbe4338706

Download Submit
\Users\Admin\AppData\Roaming\Cumax\ytosi.exe

Filesize
212KB

MD5
f1a95e1188877bb7907718ec51df6825

SHA1
beecaae344e95afb35088129f25710fb2167707e

SHA256
4440c610862ca5396a7e377b50d452cebb1ecc12f5b8c6954575c9b60925dea6

SHA512
5bf4a0d5a194106255ee10b47a500115135994371cd788d7644674aaa7d4dcb3efbfd4263c9ec8406478374c0c119d814d1f21adc4c103dc6d427ba613284f2b

Download Submit
memory/1252-47-0x0000000002070000-0x00000000020A9000-memory.dmp

Filesize
228KB

Download
memory/1252-49-0x0000000002070000-0x00000000020A9000-memory.dmp

Filesize
228KB

Download
memory/1252-41-0x0000000002070000-0x00000000020A9000-memory.dmp

Filesize
228KB

Download
memory/1252-45-0x0000000002070000-0x00000000020A9000-memory.dmp

Filesize
228KB

Download
memory/1252-43-0x0000000002070000-0x00000000020A9000-memory.dmp

Filesize
228KB

Download
memory/1336-54-0x0000000001ED0000-0x0000000001F09000-memory.dmp

Filesize
228KB

Download
memory/1336-52-0x0000000001ED0000-0x0000000001F09000-memory.dmp

Filesize
228KB

Download
memory/1336-53-0x0000000001ED0000-0x0000000001F09000-memory.dmp

Filesize
228KB

Download
memory/1336-55-0x0000000001ED0000-0x0000000001F09000-memory.dmp

Filesize
228KB

Download
memory/1376-57-0x0000000002AD0000-0x0000000002B09000-memory.dmp

Filesize
228KB

Download
memory/1376-58-0x0000000002AD0000-0x0000000002B09000-memory.dmp

Filesize
228KB

Download
memory/1376-59-0x0000000002AD0000-0x0000000002B09000-memory.dmp

Filesize
228KB

Download
memory/1376-60-0x0000000002AD0000-0x0000000002B09000-memory.dmp

Filesize
228KB

Download
memory/1488-68-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/1488-66-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/1488-62-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/1488-64-0x0000000000250000-0x0000000000289000-memory.dmp

Filesize
228KB

Download
memory/2180-102-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2180-98-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2180-73-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-72-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-75-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-81-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2180-82-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-84-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-86-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2180-90-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2180-92-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-94-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2180-96-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-74-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-100-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-88-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-79-0x00000000035C0000-0x00000000035C1000-memory.dmp

Filesize
4KB

Download
memory/2180-76-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2180-876-0x0000000003440000-0x0000000003479000-memory.dmp

Filesize
228KB

Download
memory/2584-681-0x0000000000050000-0x0000000000089000-memory.dmp

Filesize
228KB

Download
memory/2584-689-0x0000000077A50000-0x0000000077A51000-memory.dmp

Filesize
4KB

Download
memory/2584-875-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2584-892-0x0000000000050000-0x0000000000089000-memory.dmp

Filesize
228KB

Download
memory/2788-27-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/2788-447-0x00000000003A0000-0x00000000003D9000-memory.dmp

Filesize
228KB

Download
memory/2788-680-0x00000000003A0000-0x00000000003D9000-memory.dmp

Filesize
228KB

Download
memory/2788-26-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download