Analysis
-
max time kernel
162s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 09:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4086d252c6f4d826b13183cf35884794.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4086d252c6f4d826b13183cf35884794.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4086d252c6f4d826b13183cf35884794.exe
-
Size
116KB
-
MD5
4086d252c6f4d826b13183cf35884794
-
SHA1
5943564c602a412ca2bf0bb4aea1235c164baa55
-
SHA256
56c595e6720eec4a4e33555f1b9afc592b598e13431eae78244da2efd56325f1
-
SHA512
0e47b019370a093e4f32bf324becf757de3d154734513d710f5ee2a2c43f4c98727b36fc733c9560271af02377a82b46f342c8d4a6140b68d0651fc63be2b2d1
-
SSDEEP
1536:dsJghTRdSkOjs8koyAFx57YjHzZ5oFD7jkt5ycQg:aCXovjMLdjHzbotjyLX
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4086d252c6f4d826b13183cf35884794.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yeape.exe -
Executes dropped EXE 1 IoCs
pid Process 2312 yeape.exe -
Loads dropped DLL 2 IoCs
pid Process 2116 4086d252c6f4d826b13183cf35884794.exe 2116 4086d252c6f4d826b13183cf35884794.exe -
Adds Run key to start application 2 TTPs 26 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /e" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /g" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /c" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /j" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /p" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /i" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /d" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /f" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /y" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /s" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /a" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /o" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /l" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /k" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /q" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /b" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /x" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /r" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /t" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /m" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /u" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /w" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /p" 4086d252c6f4d826b13183cf35884794.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /v" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /h" yeape.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\yeape = "C:\\Users\\Admin\\yeape.exe /n" yeape.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2116 4086d252c6f4d826b13183cf35884794.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe 2312 yeape.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2116 4086d252c6f4d826b13183cf35884794.exe 2312 yeape.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2312 2116 4086d252c6f4d826b13183cf35884794.exe 27 PID 2116 wrote to memory of 2312 2116 4086d252c6f4d826b13183cf35884794.exe 27 PID 2116 wrote to memory of 2312 2116 4086d252c6f4d826b13183cf35884794.exe 27 PID 2116 wrote to memory of 2312 2116 4086d252c6f4d826b13183cf35884794.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\4086d252c6f4d826b13183cf35884794.exe"C:\Users\Admin\AppData\Local\Temp\4086d252c6f4d826b13183cf35884794.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\yeape.exe"C:\Users\Admin\yeape.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD52bad899cda49cc1f1b7b56cf10260446
SHA123ad30aba8722a93cedae8c8946a7c96e62bdf03
SHA256a99c0d8e55232d980c7b42696436e3dc4b9ab187a3ee48f7696031886881c503
SHA51270ee2d8971921dbe389de3ff9f97cb6ef603e5028fcb60e11c0aa36e88c19a852146fc4dfafbe024f8a275e3a062b69248290c88cd89f116094f78181a4f5dcc