Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 12:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Yale.1.24.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
Yale.1.24.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target Yale.1.24.exe
- Size 636KB
- Sample260722-pkckqa1wcs
- SHA256 2fe4827ffb39b2498dc30ea0ab9f0d0df68258aea6c2ba5fc65181b9e854fde0
- MD5 c8dc2330aa40e4d4c3e594ba4a4f3d3c
- SHA1 98bfe87ba19f62efcd3c9a00c8f4408496156a7a
- SHA512 71c905affb95ab4d080f5a83f8069791f9ddef3fcb1df67becfa2df9b4f06902a8966e2728f1be66a20115c10017453c25a87972fbfc1db29ecc479434d00b8b
- SSDEEP 6144:xdmKzHydv66edRnhHYRPM2GhW0ABQhGLIe0SagCw5XV4clFfByi5BgSqjDwWai4:+2H8md2G+BS0SSag/z4cffp7pCmZ8V
- TLSH T134D48D01FAE2D0F5CA4561701C6ABB3AE6759E864B345FD373D8FD2A2C722D1A13B109
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Maps connected drives based on registry 3 TTPs 3 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Yale.1.24.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count Yale.1.24.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Yale.1.24.exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\netpgm.inf_amd64_e6056dd104739d94\netpgm.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\netirda.inf_amd64_be43c3c0282f17c0\netirda.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\netlldp.inf_amd64_a15144f6701114f5\netlldp.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\netrast.inf_amd64_f955916b393df102\netrast.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisimplatform.inf_amd64_9cdd0469b25e5eb6\ndisimplatform.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\rspndr.inf_amd64_40d7d509bffdbfdf\rspndr.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\ndisuio.inf_amd64_b2456fcb7940051c\ndisuio.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc_vfpp.inf_amd64_e2df654f7fb2a09a\wnetvsc_vfpp.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\nettcpip.inf_amd64_486917bd656ea4cc\nettcpip.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\c_nettrans.inf_amd64_47740bd5db28c0a9\c_nettrans.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\netip6.inf_amd64_d4e65cefa39141c1\netip6.PNF Yale.1.24.exe File created C:\Windows\System32\DriverStore\FileRepository\lltdio.inf_amd64_81fb802404f71ca6\lltdio.PNF Yale.1.24.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log Yale.1.24.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Yale.1.24.exe - Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ Yale.1.24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A Yale.1.24.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ Yale.1.24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 Yale.1.24.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ Yale.1.24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 Yale.1.24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A Yale.1.24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 Yale.1.24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A Yale.1.24.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ Yale.1.24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 Yale.1.24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A Yale.1.24.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4848 Yale.1.24.exe 4848 Yale.1.24.exe 4848 Yale.1.24.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4848 Yale.1.24.exe 4848 Yale.1.24.exe 4848 Yale.1.24.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4848 Yale.1.24.exe 4848 Yale.1.24.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Yale.1.24.exe"C:\Users\Admin\AppData\Local\Temp\Yale.1.24.exe"1⤵
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4848