Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06-01-2024 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4757bfc0ca2cf9c44700dc7c62d9f361.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4757bfc0ca2cf9c44700dc7c62d9f361.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4757bfc0ca2cf9c44700dc7c62d9f361.exe
-
Size
312KB
-
MD5
4757bfc0ca2cf9c44700dc7c62d9f361
-
SHA1
951099744888460018f1fdf738e43f5ee3dffcf2
-
SHA256
55b0000c25f39aea4b6750bc0c9db591d0f83b13f788a506460ab3a3a2cac44e
-
SHA512
99de2eb68ff103833de95a5d98e6e976dafc60dd1d45bf1272f607011b846d86f6b88461bd51d99dd934e55987fc016ae60c020d00bd552bef3a5d1791ad3976
-
SSDEEP
6144:8KkafWxJYw4xusHwsY0sQenWuPxnyXX7:9fWxJIAsQsY0+R
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4757bfc0ca2cf9c44700dc7c62d9f361.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" yoowu.exe -
Executes dropped EXE 1 IoCs
pid Process 1824 yoowu.exe -
Loads dropped DLL 2 IoCs
pid Process 2540 4757bfc0ca2cf9c44700dc7c62d9f361.exe 2540 4757bfc0ca2cf9c44700dc7c62d9f361.exe -
Adds Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /g" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /z" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /f" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /i" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /h" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /s" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /o" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /m" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /l" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /r" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /t" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /n" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /p" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /y" 4757bfc0ca2cf9c44700dc7c62d9f361.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /y" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /w" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /d" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /v" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /a" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /c" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /x" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /b" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /q" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /u" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /j" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /e" yoowu.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\yoowu = "C:\\Users\\Admin\\yoowu.exe /k" yoowu.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2540 4757bfc0ca2cf9c44700dc7c62d9f361.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe 1824 yoowu.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2540 4757bfc0ca2cf9c44700dc7c62d9f361.exe 1824 yoowu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2540 wrote to memory of 1824 2540 4757bfc0ca2cf9c44700dc7c62d9f361.exe 28 PID 2540 wrote to memory of 1824 2540 4757bfc0ca2cf9c44700dc7c62d9f361.exe 28 PID 2540 wrote to memory of 1824 2540 4757bfc0ca2cf9c44700dc7c62d9f361.exe 28 PID 2540 wrote to memory of 1824 2540 4757bfc0ca2cf9c44700dc7c62d9f361.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4757bfc0ca2cf9c44700dc7c62d9f361.exe"C:\Users\Admin\AppData\Local\Temp\4757bfc0ca2cf9c44700dc7c62d9f361.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\yoowu.exe"C:\Users\Admin\yoowu.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1824
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD598011935974f7c2b60ac335013677ce6
SHA1710c57aa95dbdf2e946bf1b9f058d2db5f63e246
SHA256673cac15eed43b243cdad3d8f2349265b66c23e491453574e63156ba13c0dc32
SHA5123650847b54ffec13dfeb024aeab495332180b0401d2cdcec95b47f13dde1b44134a1cc4fd93281072e6978db5f94426036c3212903f4fa839d99b91bf2f3d175
-
Filesize
312KB
MD5d30eeda1ced4d54716a8acbdff255028
SHA15ca4ac535fcafe9335cbb08f8dcb02f4c4e1ff96
SHA25644974e9a0a445e045ac09ba177ff03f91e115647e7db1538302cd97149749121
SHA512e7da1f4fbd116421038a715a8d81bdef911015ca42b471325e1fa8341d8818379fd3b426fb4d2ca0e32f2d2b1eb069c51b30fbb25996aa4088ac48193de050dc
-
Filesize
93KB
MD572ba4a9d5128c73d1bd04f89ca863b6a
SHA149d143555cbf8d2cac22a5313fd693f272dd4056
SHA25648a020e3219cf7b492252ecab04b566bcadc0f96e711c2a62acd295d2101b559
SHA512f192c58951b73a0f102317aefb17480de583b0ee44467fa05bae2ce1e98fb24a5cbc1f48d348cdebdfbde14d69e775f2af28954b6ba3be2d0d7223531862ccc1