7b2b2bf953b870564bff1f308381d9e20e84c2577bd8c854710e4f71438b2981

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 11:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMPYtbn/ytb_c.exe
Size

354KB
MD5

7d18bc75c1819350283c71c6fd3c4f58
SHA1

aa06961eb254365bf95ea1185932c3f71dfbbfa0
SHA256

9626df7ff25c020099504c1527025b056ef27b74e1d92d195996687344b1922b
SHA512

bd3d02f7e71aadb51f82b463826de1b0bcb4de18389c792783ae048e51fa11278f49118339a8b76f82b5d86af533e0b675a82e912196f4cadad5e199118cc941
SSDEEP

6144:IBC1M8Aw62d5DMQ4MRf2GcHGTPZoed2tLDCDL9M+e7mAnFU4IMBuRoBk4:IQD5DMSaGloediLDCDpM+e7mS1Bnk4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytb_c.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	ytb_c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	ytb_c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	ytb_c.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2728	ytb_c.exe
2728	ytb_c.exe
2728	ytb_c.exe
2728	ytb_c.exe

C:\Users\Admin\AppData\Local\Temp\$TEMPYtbn\ytb_c.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMPYtbn\ytb_c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d189474ae940d865aa1be41c650c4935

SHA1
5bd135fabca010a07bea861b03752fcb059744a7

SHA256
d7c82b924630b1ac56ff96c6b7a113218b125bf84ae7cf7392df5db649927727

SHA512
403f69c29dc1d16981fe3194425c62cbbd01e0feeccffb9af7211669f575aa1ef9be842be2db130defc9d959ec073f7f8703a832437dc80b350284a7f8cd0063

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
764a889504c34cb09665b774269def79

SHA1
48d42a016406429b8a18425136178d2f9a333edc

SHA256
ca9b18e48f44d3598a121e7ba0192c417add015d0361ad0b5b83db879daea491

SHA512
ebfb555a444d1af48cb15cea2907c74e54cd323e5e72b3322f9e15bb473e5300a054c826b8f1f577342373edfdafee9d5193fed3645b6ee7fcb5b5f7f255909e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ee51a8afd87c17ad789353f4e4de872

SHA1
2556bc038105fdf0b962a99455092f17d8c1fc8d

SHA256
7a4cb310cd20928f9d355534c496c6d63fb1c1fbf59933fb4a57ce657918d815

SHA512
241b93a501b0875a5222ee4de1dded05b11dad6f0602019827552fcea8a17be2ef0dbc99cf085bac7016111a197b854cba3f4b1be17ccdfbc2119c02b8958e99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5cde114ec3e711d464ae9c773c655e7

SHA1
d2a611cce265a87265f8439fc0ffa79996ba8611

SHA256
6d39f8af38fde0f04714632a826403b47b7c55b64db80317a8fd7af1d0deaa65

SHA512
47704dea4ffa3f24c0cbf83af93b2f7d5fe9a8c7d35347cd9e45602f54949d30d3c7ef3042d45d3ae34c985047f799898d085af199c99d38282dfd77509951bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88c3c1f41d92844ad85bb8edfbf21a2c

SHA1
9993e1323a0dbd434efdb931145d9b8edefeaccb

SHA256
ea6e168554fba3d2de61fc2b821a19dfce86680c6df57a7f64219c59f9862f26

SHA512
8df656c789d05b53c62913c6bc0832dbc5dd6fb0c61f96489bee2ddb570e69f477b9c6215b0724dd9179f28f6b0e26dfca196fc907928f1ce5a094f562a58199

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74150d1e397cf72adb4d39547212f3f1

SHA1
9c300d23ae8ca34f27054a7eedbf3f7e523fd550

SHA256
5e0684c26e25ce61c6f585ac77a16ae0bbde43e930af6097bf64b14fe27d5806

SHA512
f681a395e830be6e910ecfa1550e8ef1914efca2fcb0c92ae757c46bd90f72a45ce0f031a111ed73d86faaa99eb6e00a085e214591d8d66f326043f45cc50c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4123f8103eed59beeecfac43bb41b3a2

SHA1
8a2f1e2d2aff44a38beceaf47a995e8ae0d9a6a8

SHA256
c16a52dc300d983bfa3d471f93495181b89309c769aebe30db437b8b828fc14b

SHA512
99e08b825b23eccc313233854d617c9a6ab9afc199d365899b13fa60308e5b97d2c48c7d93d36ed2741690c1d196920fef2944465f932b6e9caa1700f24f83d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
765929203bd77ad66554d94811a1f9d6

SHA1
df045ea4c100ec6a3022aeaeced02315e4ea2b33

SHA256
bdbc17c3ca56ca53033a0042f52083f3710267c2a80407417fda2ec5f3c26212

SHA512
5c209a4f474ed524cc074044bfc6cce5d9ea71fd622eb1cbbb55745635e9fe543fd0dc12d82bd5ffb7280e99f2ea9e7980feadd0ac2ad6abb0fc1da61714d0f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08056eb07d4a2bd2d501b9106b749074

SHA1
6183d8cadec0746c6f695f5e657d5159e577a33b

SHA256
6f6e2247a68e2ffb50a69b2314a579c14d1ceda499890c6acdb9da4fb242972d

SHA512
4d7331cde8c8811d9e899aadd6386d6b6b7c6efe5bb946dc45f911066609832f5a51f80b226522bebee8a567506266d3e2cb9d23ceced50520e492bbf8733beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab588E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar591D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit