662b3372540e486334dc3395a5abbb35a1499295dc238d25828c4664145ff110

General

Target
20240106b920bbb7246337069ab2710414a6f6d7lock.exe
Size 256KB
Sample240107-x3erssdcc7
SHA256 662b3372540e486334dc3395a5abbb35a1499295dc238d25828c4664145ff110
MD5 b920bbb7246337069ab2710414a6f6d7
SHA1 42efa702ed854055daf7e0eebf0b581474e5ab15
SHA512 c6ef64c4992dfc16be87844da9d241508ef2be886d1754c294805753382f32d1ded0b3cfc1469e8cb2eb04874d354994d3ee105df95f8a9a7613a4ebd8562d88
SSDEEP 6144:DCIo56VkA5n9VPvKNem3QYhYkOf/UWgqd:DCIac5n3nY9yD/bDd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
5108	YYUsYIsE.exe
3140	uSoIkwIE.exe
1528	cinst.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YYUsYIsE.exe = "C:\\Users\\Admin\\xIUEsIEc\\YYUsYIsE.exe"	YYUsYIsE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uSoIkwIE.exe = "C:\\ProgramData\\YOssEYoE\\uSoIkwIE.exe"	uSoIkwIE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YYUsYIsE.exe = "C:\\Users\\Admin\\xIUEsIEc\\YYUsYIsE.exe"	20240106b920bbb7246337069ab2710414a6f6d7lock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uSoIkwIE.exe = "C:\\ProgramData\\YOssEYoE\\uSoIkwIE.exe"	20240106b920bbb7246337069ab2710414a6f6d7lock.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1164	reg.exe
5028	reg.exe
2932	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe
3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe
3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe
3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 5108	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	33
PID 3548 wrote to memory of 5108	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	33
PID 3548 wrote to memory of 5108	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	33
PID 3548 wrote to memory of 3140	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	32
PID 3548 wrote to memory of 3140	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	32
PID 3548 wrote to memory of 3140	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	32
PID 3548 wrote to memory of 1940	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	31
PID 3548 wrote to memory of 1940	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	31
PID 3548 wrote to memory of 1940	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	31
PID 1940 wrote to memory of 1528	1940	cmd.exe	30
PID 1940 wrote to memory of 1528	1940	cmd.exe	30
PID 3548 wrote to memory of 2932	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	29
PID 3548 wrote to memory of 2932	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	29
PID 3548 wrote to memory of 2932	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	29
PID 3548 wrote to memory of 5028	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	28
PID 3548 wrote to memory of 5028	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	28
PID 3548 wrote to memory of 5028	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	28
PID 3548 wrote to memory of 1164	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	27
PID 3548 wrote to memory of 1164	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	27
PID 3548 wrote to memory of 1164	3548	20240106b920bbb7246337069ab2710414a6f6d7lock.exe	27

C:\Users\Admin\AppData\Local\Temp\20240106b920bbb7246337069ab2710414a6f6d7lock.exe
"C:\Users\Admin\AppData\Local\Temp\20240106b920bbb7246337069ab2710414a6f6d7lock.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:1164
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:5028
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies registry key
  PID:2932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\cinst.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- C:\ProgramData\YOssEYoE\uSoIkwIE.exe
  "C:\ProgramData\YOssEYoE\uSoIkwIE.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3140
- C:\Users\Admin\xIUEsIEc\YYUsYIsE.exe
  "C:\Users\Admin\xIUEsIEc\YYUsYIsE.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5108