abf9d15bdb0be1ca757991160286bfa302a55c964930878d7cdeba77d15d2918

General

Target

f601666ae809e043bdb7da8768dc73ca.exe
Size

240KB
MD5

f601666ae809e043bdb7da8768dc73ca
SHA1

4727f659fdafd7edbe2b5ae3426e7274d0d71f9c
SHA256

abf9d15bdb0be1ca757991160286bfa302a55c964930878d7cdeba77d15d2918
SHA512

c9bbd142123ff7d3b82ffe29c3400abad41b3bab01a1333197f2a404ed635bf33a9a5842fcf1034888dcd3189907e90fccef2ed4a1d493fe5739ba0be6e49cd3
SSDEEP

3072:akNFT8j6VlpvBd90i/SmWKLi7CjFSivnfu3fbMdozt5cz+G1:ay0UGKGkFRKfeoztOH

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vsyuuc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	f601666ae809e043bdb7da8768dc73ca.exe

Executes dropped EXE 1 IoCs

pid	Process
1340	vsyuuc.exe

Loads dropped DLL 2 IoCs

pid	Process
2144	f601666ae809e043bdb7da8768dc73ca.exe
2144	f601666ae809e043bdb7da8768dc73ca.exe

Adds Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /u"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /g"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /v"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /o"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /x"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /t"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /h"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /n"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /l"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /a"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /e"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /m"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /s"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /f"	f601666ae809e043bdb7da8768dc73ca.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /j"	vsyuuc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\vsyuuc = "C:\\Users\\Admin\\vsyuuc.exe /k"	vsyuuc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2144	f601666ae809e043bdb7da8768dc73ca.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe
1340	vsyuuc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2144	f601666ae809e043bdb7da8768dc73ca.exe
1340	vsyuuc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1340	2144	f601666ae809e043bdb7da8768dc73ca.exe	28
PID 2144 wrote to memory of 1340	2144	f601666ae809e043bdb7da8768dc73ca.exe	28
PID 2144 wrote to memory of 1340	2144	f601666ae809e043bdb7da8768dc73ca.exe	28
PID 2144 wrote to memory of 1340	2144	f601666ae809e043bdb7da8768dc73ca.exe	28

C:\Users\Admin\AppData\Local\Temp\f601666ae809e043bdb7da8768dc73ca.exe
"C:\Users\Admin\AppData\Local\Temp\f601666ae809e043bdb7da8768dc73ca.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\vsyuuc.exe
  "C:\Users\Admin\vsyuuc.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\vsyuuc.exe

Filesize
240KB

MD5
1bb13ff3f948263a3eb8124a282f24c6

SHA1
cdfd10a1d9fcc9f53ebd197c493dd08e99a62a7a

SHA256
3d382aaec9c0dfbe5a54507e6c2bc1dfe8a5256f31fe9f3b326521fc1d463b2b

SHA512
728548fd68d6f13df022319d23f77ff15cd9b8a503eb004b60a85ad1553071999fe066f16f6583dd8dc9769158c3bca3a89a543933ed1bd1798a92fbb0b41233

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads