General
- Target YuukiPS_2.0.15_x64-setup.exe
- Size 4.5MB
- Sample260724-v7m8mattfs
- SHA256 7acb92c9349d251a199de8e7cc16c96c1bc969c3225062a1c7097fa1be45eac6
Malware Config
Targets
-
- Target YuukiPS_2.0.15_x64-setup.exe
- Size 4.5MB
- SHA256 7acb92c9349d251a199de8e7cc16c96c1bc969c3225062a1c7097fa1be45eac6
Score8/10Downloads MZ/PE file
Drops file in Drivers directory
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Network Share Discovery
Attempt to gather information on host network.
Suspicious use of NtCreateThreadExHideFromDebugger
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target yuukips-launcher.exe
- Size 9.9MB
- SHA256 630e1af0ff2eb9e8312733a66519a3f8ca221bb2f91596eb22597084ff55d319
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Checks whether UAC is enabled
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Network Share Discovery
Attempt to gather information on host network.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1