af9f8f329e93f6086b6b889569d59dcc7491c99d90018f14ab672d9a8f53ca20

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7481cceec63a7fc36bf29743c73fc3dc.exe
Size

191KB
MD5

7481cceec63a7fc36bf29743c73fc3dc
SHA1

bee5f73b225e84f1cafd8472ef76be272ceb38b0
SHA256

af9f8f329e93f6086b6b889569d59dcc7491c99d90018f14ab672d9a8f53ca20
SHA512

9872edd5c0bfbaacb85513e69871ca4efc42b14ffc026c3764e602e2c50217fdb441c38648b22344f26e041f1d28cae7e2e7dd1e7ddb998d25a9267c646d6aa6
SSDEEP

3072:r5sSIMHJY1a0crx/S7weJNKjgics+Ufi4N9LAWLgX4W3VsmL1cRur6jVJ9T/RNoS:r5NfpY2SJ3ugiCUYWLm4W3VsAcRuWjrj

Score

7^/10

persistence upx

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1944	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2068	yhewy.exe

Loads dropped DLL 2 IoCs

pid	Process
1696	7481cceec63a7fc36bf29743c73fc3dc.exe
1696	7481cceec63a7fc36bf29743c73fc3dc.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1696-0-0x0000000000400000-0x0000000000453000-memory.dmp	upx
behavioral1/files/0x0008000000012261-6.dat	upx
behavioral1/memory/2068-14-0x0000000000400000-0x0000000000453000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\{C773A8B7-4B6A-B849-361E-598F70FD21B7} = "C:\\Users\\Admin\\AppData\\Roaming\\Ihohe\\yhewy.exe"	yhewy.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1696 set thread context of 1944	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	30

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Privacy	7481cceec63a7fc36bf29743c73fc3dc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Privacy\CleanCookies = "0"	7481cceec63a7fc36bf29743c73fc3dc.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\22DE7944-00000001.eml:OECustomProperty	WinMail.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe
2068	yhewy.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1696	7481cceec63a7fc36bf29743c73fc3dc.exe
Token: SeSecurityPrivilege	1696	7481cceec63a7fc36bf29743c73fc3dc.exe
Token: SeSecurityPrivilege	1696	7481cceec63a7fc36bf29743c73fc3dc.exe
Token: SeManageVolumePrivilege	2232	WinMail.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	WinMail.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2232	WinMail.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	WinMail.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2068	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	28
PID 1696 wrote to memory of 2068	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	28
PID 1696 wrote to memory of 2068	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	28
PID 1696 wrote to memory of 2068	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	28
PID 2068 wrote to memory of 1124	2068	yhewy.exe	11
PID 2068 wrote to memory of 1124	2068	yhewy.exe	11
PID 2068 wrote to memory of 1124	2068	yhewy.exe	11
PID 2068 wrote to memory of 1124	2068	yhewy.exe	11
PID 2068 wrote to memory of 1124	2068	yhewy.exe	11
PID 2068 wrote to memory of 1228	2068	yhewy.exe	15
PID 2068 wrote to memory of 1228	2068	yhewy.exe	15
PID 2068 wrote to memory of 1228	2068	yhewy.exe	15
PID 2068 wrote to memory of 1228	2068	yhewy.exe	15
PID 2068 wrote to memory of 1228	2068	yhewy.exe	15
PID 2068 wrote to memory of 1276	2068	yhewy.exe	12
PID 2068 wrote to memory of 1276	2068	yhewy.exe	12
PID 2068 wrote to memory of 1276	2068	yhewy.exe	12
PID 2068 wrote to memory of 1276	2068	yhewy.exe	12
PID 2068 wrote to memory of 1276	2068	yhewy.exe	12
PID 2068 wrote to memory of 760	2068	yhewy.exe	14
PID 2068 wrote to memory of 760	2068	yhewy.exe	14
PID 2068 wrote to memory of 760	2068	yhewy.exe	14
PID 2068 wrote to memory of 760	2068	yhewy.exe	14
PID 2068 wrote to memory of 760	2068	yhewy.exe	14
PID 2068 wrote to memory of 1696	2068	yhewy.exe	27
PID 2068 wrote to memory of 1696	2068	yhewy.exe	27
PID 2068 wrote to memory of 1696	2068	yhewy.exe	27
PID 2068 wrote to memory of 1696	2068	yhewy.exe	27
PID 2068 wrote to memory of 1696	2068	yhewy.exe	27
PID 1696 wrote to memory of 1944	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	30
PID 1696 wrote to memory of 1944	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	30
PID 1696 wrote to memory of 1944	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	30
PID 1696 wrote to memory of 1944	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	30
PID 1696 wrote to memory of 1944	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	30
PID 1696 wrote to memory of 1944	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	30
PID 1696 wrote to memory of 1944	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	30
PID 1696 wrote to memory of 1944	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	30
PID 1696 wrote to memory of 1944	1696	7481cceec63a7fc36bf29743c73fc3dc.exe	30
PID 2068 wrote to memory of 1356	2068	yhewy.exe	32
PID 2068 wrote to memory of 1356	2068	yhewy.exe	32
PID 2068 wrote to memory of 1356	2068	yhewy.exe	32
PID 2068 wrote to memory of 1356	2068	yhewy.exe	32
PID 2068 wrote to memory of 1356	2068	yhewy.exe	32
PID 2068 wrote to memory of 2188	2068	yhewy.exe	33
PID 2068 wrote to memory of 2188	2068	yhewy.exe	33
PID 2068 wrote to memory of 2188	2068	yhewy.exe	33
PID 2068 wrote to memory of 2188	2068	yhewy.exe	33
PID 2068 wrote to memory of 2188	2068	yhewy.exe	33
PID 2068 wrote to memory of 2568	2068	yhewy.exe	34
PID 2068 wrote to memory of 2568	2068	yhewy.exe	34
PID 2068 wrote to memory of 2568	2068	yhewy.exe	34
PID 2068 wrote to memory of 2568	2068	yhewy.exe	34
PID 2068 wrote to memory of 2568	2068	yhewy.exe	34

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1124

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276
- C:\Users\Admin\AppData\Local\Temp\7481cceec63a7fc36bf29743c73fc3dc.exe
  "C:\Users\Admin\AppData\Local\Temp\7481cceec63a7fc36bf29743c73fc3dc.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Modifies Internet Explorer settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Roaming\Ihohe\yhewy.exe
    "C:\Users\Admin\AppData\Roaming\Ihohe\yhewy.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp5eabc4e2.bat"
    3⤵
    - Deletes itself
    PID:1944

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:760

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1228

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2232

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1356

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2188

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edb.log

Filesize
2.0MB

MD5
a1b6c3695845f0291580c6159a8a99a1

SHA1
38d2707016573e4a016712a386c9d1984f955834

SHA256
bce50ad0b1db394d9dea821b2bec48a9d04f1cd42e82befb018a8cfd10863ba1

SHA512
8ca44c196358008fbf6b3fa532b168b6312fae6bebcb72f7b1143272849fb036890e9c1e5c51eebcbd89224944ea423f619f6231e6c26912250b4789a846ce3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5eabc4e2.bat

Filesize
243B

MD5
b3eee965461bf5b7c8d7fd6b3ea820b2

SHA1
c25667404c753c5d09c845bd24e01d26a50ee127

SHA256
9fefb7bf096922f5c9d78e8272cb6ab0552949da83cc23beade959517416f9e0

SHA512
6bf128c7daf5f90be078f0a3b655f7466756723fb9eba92f086a9a8a7752244a6963e112189b9828f468da019c23169fee349d08ecc02ce0760eea70c7733d3b

Download Submit
C:\Users\Admin\AppData\Roaming\Uzis\luhua.liu

Filesize
366B

MD5
1590ce9e2cc236c22f1575d91466b8b8

SHA1
82a6532e436cc5ed363a64437808033120f2f777

SHA256
7feb23e37c57a30bbaf515ebad823a0a35d2259b3906e0f89a78ad4550924ba1

SHA512
9c1c5f8180017f2ea14876f4eff07f276df60353d9dbe4bbc1b3f886a2b52da50c86c478b30375232ec8e5ab6260fcf8770dc84422b41a407d356472603fecd0

Download Submit
\Users\Admin\AppData\Roaming\Ihohe\yhewy.exe

Filesize
191KB

MD5
ce88e8e7a7910759f0da848db5a303ea

SHA1
476a43256b9a3009b2de1ec64201eecdaf12f77e

SHA256
0b70d7440118e6e90a92568177289968906d2dc36ba7704ca9afdca489993b37

SHA512
05506a57869232929f09df6cb10d418818fcf9a131a33f89848e7b18f57ee213bc4f2a788be6fad6e402661ffdedc84e1ff31ad6cd2ad284abcb8e13a6760a1e

Download Submit
memory/760-41-0x0000000000250000-0x0000000000277000-memory.dmp

Filesize
156KB

Download
memory/760-39-0x0000000000250000-0x0000000000277000-memory.dmp

Filesize
156KB

Download
memory/760-45-0x0000000000250000-0x0000000000277000-memory.dmp

Filesize
156KB

Download
memory/760-43-0x0000000000250000-0x0000000000277000-memory.dmp

Filesize
156KB

Download
memory/1124-21-0x0000000000330000-0x0000000000357000-memory.dmp

Filesize
156KB

Download
memory/1124-25-0x0000000000330000-0x0000000000357000-memory.dmp

Filesize
156KB

Download
memory/1124-23-0x0000000000330000-0x0000000000357000-memory.dmp

Filesize
156KB

Download
memory/1124-17-0x0000000000330000-0x0000000000357000-memory.dmp

Filesize
156KB

Download
memory/1124-19-0x0000000000330000-0x0000000000357000-memory.dmp

Filesize
156KB

Download
memory/1228-28-0x0000000001BD0000-0x0000000001BF7000-memory.dmp

Filesize
156KB

Download
memory/1228-29-0x0000000001BD0000-0x0000000001BF7000-memory.dmp

Filesize
156KB

Download
memory/1228-30-0x0000000001BD0000-0x0000000001BF7000-memory.dmp

Filesize
156KB

Download
memory/1276-33-0x0000000002970000-0x0000000002997000-memory.dmp

Filesize
156KB

Download
memory/1276-36-0x0000000002970000-0x0000000002997000-memory.dmp

Filesize
156KB

Download
memory/1276-35-0x0000000002970000-0x0000000002997000-memory.dmp

Filesize
156KB

Download
memory/1276-34-0x0000000002970000-0x0000000002997000-memory.dmp

Filesize
156KB

Download
memory/1696-58-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-70-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-12-0x0000000000380000-0x00000000003D3000-memory.dmp

Filesize
332KB

Download
memory/1696-51-0x0000000000380000-0x00000000003A7000-memory.dmp

Filesize
156KB

Download
memory/1696-53-0x0000000000380000-0x00000000003A7000-memory.dmp

Filesize
156KB

Download
memory/1696-55-0x0000000000380000-0x00000000003A7000-memory.dmp

Filesize
156KB

Download
memory/1696-3-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1696-57-0x0000000000380000-0x00000000003A7000-memory.dmp

Filesize
156KB

Download
memory/1696-60-0x0000000076F00000-0x0000000076F01000-memory.dmp

Filesize
4KB

Download
memory/1696-61-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-64-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-62-0x0000000076F00000-0x0000000076F01000-memory.dmp

Filesize
4KB

Download
memory/1696-68-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-66-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-72-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-49-0x0000000000380000-0x00000000003A7000-memory.dmp

Filesize
156KB

Download
memory/1696-74-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-76-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-78-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-80-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-149-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1696-2-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1696-189-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1696-1-0x0000000000230000-0x0000000000245000-memory.dmp

Filesize
84KB

Download
memory/1696-236-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1696-237-0x0000000000380000-0x00000000003A7000-memory.dmp

Filesize
156KB

Download
memory/1696-0-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1944-245-0x0000000076F00000-0x0000000076F01000-memory.dmp

Filesize
4KB

Download
memory/1944-241-0x0000000000050000-0x0000000000077000-memory.dmp

Filesize
156KB

Download
memory/1944-333-0x0000000000050000-0x0000000000077000-memory.dmp

Filesize
156KB

Download
memory/2068-14-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2068-334-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download