95288d36ad27ac20db2858bea3e78a38de19b2dcfa4ca8c293bb98f3529676ee

General

Target

ff4900d0f5639f8b94f2a3bd4abdf060.exe
Size

152KB
MD5

ff4900d0f5639f8b94f2a3bd4abdf060
SHA1

1cc833b741a6848699b311ecd229dcb6df211cf2
SHA256

95288d36ad27ac20db2858bea3e78a38de19b2dcfa4ca8c293bb98f3529676ee
SHA512

4129d82e37b5410291c15622a18141a31a15273ca723383b6ad337dc6c1ee98495b9facb72eb82aa467318f936f339654f42f87616b4dd225f84d6f24047057e
SSDEEP

3072:BhUFg1PTQtKrueiygR4O6avJamofZ4oQZiE36:2g17QtKSMgR56avUm2W0

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ff4900d0f5639f8b94f2a3bd4abdf060.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yuaibig.exe

Executes dropped EXE 1 IoCs

pid	Process
2712	yuaibig.exe

Loads dropped DLL 2 IoCs

pid	Process
2960	ff4900d0f5639f8b94f2a3bd4abdf060.exe
2960	ff4900d0f5639f8b94f2a3bd4abdf060.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /C"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /H"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /x"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /T"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /Q"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /I"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /l"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /W"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /n"	ff4900d0f5639f8b94f2a3bd4abdf060.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /c"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /J"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /y"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /V"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /Y"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /Z"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /E"	yuaibig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\yuaibig = "C:\\Users\\Admin\\yuaibig.exe /v"	yuaibig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2960	ff4900d0f5639f8b94f2a3bd4abdf060.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe
2712	yuaibig.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2960	ff4900d0f5639f8b94f2a3bd4abdf060.exe
2712	yuaibig.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2712	2960	ff4900d0f5639f8b94f2a3bd4abdf060.exe	28
PID 2960 wrote to memory of 2712	2960	ff4900d0f5639f8b94f2a3bd4abdf060.exe	28
PID 2960 wrote to memory of 2712	2960	ff4900d0f5639f8b94f2a3bd4abdf060.exe	28
PID 2960 wrote to memory of 2712	2960	ff4900d0f5639f8b94f2a3bd4abdf060.exe	28

C:\Users\Admin\AppData\Local\Temp\ff4900d0f5639f8b94f2a3bd4abdf060.exe
"C:\Users\Admin\AppData\Local\Temp\ff4900d0f5639f8b94f2a3bd4abdf060.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\yuaibig.exe
  "C:\Users\Admin\yuaibig.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\yuaibig.exe

Filesize
92KB

MD5
fb00ed9d18f11c0866c5c969bc2bd827

SHA1
d7eb972bc9b5a9c73594d9cbe00e1297e3f770eb

SHA256
e2308361af00f6d20cfb1fb749537ae7f2c8fad0cd72398625fbcff4ac0892dd

SHA512
b1b27233c873cf98479c66cb09f083d70d461f0d6a5f6a4c26f7f452c80e1cfa0483a0108e1bc5f09ad07105c850bb89c8f037a944069d415b21e3caf8efc2b0

Download Submit
C:\Users\Admin\yuaibig.exe

Filesize
152KB

MD5
4e440e8bd1ed5ca9d0e15feee16cecc9

SHA1
56d55788cbbdc79c24c69c67a63f5455a2fe5951

SHA256
ada5ec29cfa7c08bb173bce8135e7541f4aed337d72e25f3956bf3d07eeed981

SHA512
1e4eb139262a39410d3f047e415d5ef47fd5851361d5c1d24515d7d1c7a6f59e734d622bb0c2b9f4d108cc54d08e6f69b89a774adf204f0d6bdf889a4097c77f

Download Submit
\Users\Admin\yuaibig.exe

Filesize
93KB

MD5
c206394f30ddf8e9d01409dbda0297c2

SHA1
40dae41babd0e1e3a31fdf6c705834ae57975dd0

SHA256
4a3385b6b513b4cc4b5ee0006915986418c78ed9f0891673458f228f1f9a707a

SHA512
8990517aa1280971b55aa83fc480802c667241e8bfe0d03ba08803b53e9cccabbbd4f6e287e933481b828b75e3eddbd1ac11531f6c4daf0e1a230efbfbd74ccc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads