3f5836a58eb47fcce6dc259c19023b4a9ae7e358e5d09cce078f6782259e9d48

Analysis

geolocation tags

asiadelhiinindia
max time kernel
61s
max time network
17s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yaseh.exe
Size 69.9MB
Sample260702-sp4fsagy61
SHA256 3f5836a58eb47fcce6dc259c19023b4a9ae7e358e5d09cce078f6782259e9d48
MD5 49670c277f2c6e69b623e557a1c23236
SHA1 b960be37f859758d2e64a05eb91b87c476803d06
SHA512 149cd87124b5d07b89317077936f955c06b97f2f1587e0c21de1ee4afe0f9573d12b18189334a8ae9e81e24a28e1e0708ca5d5e95bc9ebb29f82ff6b0031dee2
SSDEEP 1572864:wgWjD+RBwXzTUX0w8mxmVEt7y1ubpCwC3dUup7tR00UJsl:AP+RBwXP5fmxiE5y1ipCwQ30zo
TLSH
T1F5F72356E2FD00E8D5BAC0B8C6575517E7B2345917309BEB62648A692F33FE0AE3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution ransomware

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Yaseh.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Yaseh.exe

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Yaseh.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4528	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611f050cfb2bdaef0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801611f050c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101611f050c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3611f050c00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6611f050c00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Yaseh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Yaseh.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	Yaseh.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4528	powershell.exe
4528	powershell.exe
4528	powershell.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe
4476	Yaseh.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	Yaseh.exe
Token: SeDebugPrivilege	4528	powershell.exe
Token: SeBackupPrivilege	4884	vssvc.exe
Token: SeRestorePrivilege	4884	vssvc.exe
Token: SeAuditPrivilege	4884	vssvc.exe
Token: SeBackupPrivilege	3364	srtasks.exe
Token: SeRestorePrivilege	3364	srtasks.exe
Token: SeSecurityPrivilege	3364	srtasks.exe
Token: SeTakeOwnershipPrivilege	3364	srtasks.exe
Token: SeBackupPrivilege	3364	srtasks.exe
Token: SeRestorePrivilege	3364	srtasks.exe
Token: SeSecurityPrivilege	3364	srtasks.exe
Token: SeTakeOwnershipPrivilege	3364	srtasks.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4868	4476	Yaseh.exe	93
PID 4868 wrote to memory of 4528	4868	cmd.exe	95
PID 4476 wrote to memory of 5376	4476	Yaseh.exe	99
PID 5376 wrote to memory of 5924	5376	cmd.exe	101
PID 4476 wrote to memory of 5644	4476	Yaseh.exe	102
PID 5644 wrote to memory of 2300	5644	cmd.exe	104
PID 4476 wrote to memory of 716	4476	Yaseh.exe	105
PID 716 wrote to memory of 5736	716	cmd.exe	107
PID 4476 wrote to memory of 6004	4476	Yaseh.exe	108
PID 6004 wrote to memory of 2952	6004	cmd.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Yaseh.exe
"C:\Users\Admin\AppData\Local\Temp\Yaseh.exe"
1⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Komatuze Pre-Optimization' -RestorePointType MODIFY_SETTINGS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "Checkpoint-Computer -Description 'Komatuze Pre-Optimization' -RestorePointType MODIFY_SETTINGS"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205019.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Control_Power.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Windows\system32\reg.exe
    reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Power" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205019.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Control_Power.reg" /y
    3⤵
    PID:5924
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205019.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Control_Session Manager.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Windows\system32\reg.exe
    reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205019.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Control_Session Manager.reg" /y
    3⤵
    PID:2300
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205019.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Services_nvlddmkm.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\system32\reg.exe
    reg export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nvlddmkm" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205019.reg_HKEY_LOCAL_MACHINE_SYSTEM_CurrentControlSet_Services_nvlddmkm.reg" /y
    3⤵
    PID:5736
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c reg export "HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205019.reg_HKEY_CURRENT_USER_Software_Microsoft_Windows_DWM.reg" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\Windows\system32\reg.exe
    reg export "HKEY_CURRENT_USER\Software\Microsoft\Windows\DWM" "C:\Users\Admin\AppData\Roaming\KomatuzeOptimizer\backups\registry_backup_20260702_205019.reg_HKEY_CURRENT_USER_Software_Microsoft_Windows_DWM.reg" /y
    3⤵
    PID:2952

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1936

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4884

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4476-9-0x0000025F81300000-0x0000025F81F90000-memory.dmp

Download

memory/4476-55-0x0000025F84AB0000-0x0000025F84AF0000-memory.dmp

Download

memory/4476-51-0x0000025F84680000-0x0000025F846B0000-memory.dmp

Download

memory/4476-63-0x0000025F84CE0000-0x0000025F84D00000-memory.dmp

Download

memory/4476-59-0x0000025F84C20000-0x0000025F84C40000-memory.dmp

Download

memory/4476-47-0x0000025F80620000-0x0000025F80640000-memory.dmp

Download

memory/4476-45-0x0000025F84B90000-0x0000025F84C20000-memory.dmp

Download

memory/4476-31-0x0000025F820D0000-0x0000025F82250000-memory.dmp

Download

memory/4476-12-0x0000025F83400000-0x0000025F840F0000-memory.dmp

Download

memory/4476-39-0x0000025F84630000-0x0000025F84680000-memory.dmp

Download

memory/4476-69-0x0000025F86F80000-0x0000025F86FB0000-memory.dmp

Download

memory/4476-73-0x0000025F86F30000-0x0000025F86F40000-memory.dmp

Download

memory/4476-35-0x0000025F848B0000-0x0000025F84AB0000-memory.dmp

Download

memory/4476-27-0x0000025F80600000-0x0000025F80620000-memory.dmp

Download

memory/4476-23-0x0000025F805C0000-0x0000025F805E0000-memory.dmp

Download

memory/4476-20-0x0000025F80570000-0x0000025F80590000-memory.dmp

Download

memory/4476-15-0x0000025F840F0000-0x0000025F843D0000-memory.dmp

Download

memory/4476-77-0x0000025F870A0000-0x0000025F870C0000-memory.dmp

Download

memory/4476-85-0x0000025F87060000-0x0000025F87070000-memory.dmp

Download

memory/4476-81-0x0000025F89130000-0x0000025F891F0000-memory.dmp

Download

memory/4476-93-0x0000025F8A970000-0x0000025F8A9B0000-memory.dmp

Download

memory/4476-89-0x0000025F89260000-0x0000025F89290000-memory.dmp

Download

memory/4476-97-0x0000025F8AA30000-0x0000025F8AA80000-memory.dmp

Download

memory/4476-101-0x0000025F8BAB0000-0x0000025F8BB00000-memory.dmp

Download

memory/4476-105-0x0000025F891F0000-0x0000025F89210000-memory.dmp

Download

memory/4476-110-0x0000025F8D4F0000-0x0000025F8D660000-memory.dmp

Download

memory/4476-113-0x0000025F8C740000-0x0000025F8C840000-memory.dmp

Download

memory/4476-121-0x0000025F8C490000-0x0000025F8C4B0000-memory.dmp

Download

memory/4476-117-0x0000025F8C420000-0x0000025F8C450000-memory.dmp

Download

memory/4528-127-0x0000026BF9570000-0x0000026BF9592000-memory.dmp

Download