cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048

Analysis

max time kernel
149s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
Size

216KB
MD5

000e3b49539c7a05bd04ce3626f8cd19
SHA1

f2455b37eb2bc1dd2d89e8efd16874803cbf2903
SHA256

cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048
SHA512

b0693268653881b9bfe105445b40a9e2d1f7cb20b4b1e391d16a9c856101b4432c7064685cf75592d8678c3f9bb101a9624f6b802c3398b7e3faa2f3ee2374bc
SSDEEP

6144:H2fIfrt3+TetonBi3QxRy4g09ICSnqf9uSUgkxtpsaPjK/bEoK828fwAoEn+MM:H2Irt3+TetonBi3QxRwfnqf9uSUgkxtZ

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	yeode.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe

Executes dropped EXE 1 IoCs

pid	Process
408	yeode.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /r"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /z"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /I"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /T"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /l"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /f"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /K"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /C"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /y"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /j"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /N"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /D"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /X"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /v"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /E"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /m"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /M"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /J"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /p"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /c"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /S"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /R"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /A"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /g"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /H"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /B"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /h"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /d"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /e"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /w"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /P"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /k"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /V"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /n"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /W"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /L"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /a"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /F"	cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /Y"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /U"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /u"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /Z"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /x"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /t"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /o"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /i"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /O"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /Q"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /F"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /q"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /G"	yeode.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yeode = "C:\\Users\\Admin\\yeode.exe /s"	yeode.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2496	cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
2496	cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe
408	yeode.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2496	cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
408	yeode.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 408	2496	cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe	97
PID 2496 wrote to memory of 408	2496	cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe	97
PID 2496 wrote to memory of 408	2496	cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe	97

C:\Users\Admin\AppData\Local\Temp\cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe
"C:\Users\Admin\AppData\Local\Temp\cb014fe5c07a2fe01ba099a73a188b6f5530dc354c2e3b84c2c13ec5f4424048.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\yeode.exe
  "C:\Users\Admin\yeode.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\yeode.exe

Filesize
216KB

MD5
40ad6d074f429d802d133dced9abc628

SHA1
2bb7272bcb5436d6b184fc2e4169e4f07eae1e05

SHA256
a1c1f3b92fe9769ddb231ed4d2b18a0dcc4b7fa4e9367baf8f81bc098043556d

SHA512
87cc25cf026a8550d2259c62a7d3f06a84b05aca5012279f8a008ae55527c3e61572c73005ed1156698069cb3af9e15adaffba65044066bc78330a5d49d69747

Download Submit