Overview

overview

7

Static

static

3

yhy.exe

windows10-2004-x64

yhy.exe

windows11-ltsc_2024-x64

Analysis

  • user interaction
    yes
  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    12/10/2026, 17:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    yhy.exe
  • Size 4.9MB
  • Sample261012-v2fllayvdx
  • SHA256 b68ddd764e106845d08af6d1e13ef271e54e049c9e00d4171d5fded4e7338979
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
bootkitexecutionpersistence

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings 1 TTPs 3 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\yhy.exe
    "C:\Users\Admin\AppData\Local\Temp\yhy.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks.exe" /create /f /sc minute /mo 1 /tn "yhy" /tr "C:\Users\Admin\AppData\Roaming\yhy.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:4896
    • C:\Windows\SYSTEM32\powercfg.exe
      "powercfg" /h off
      2⤵
      • Power Settings
      • Suspicious use of AdjustPrivilegeToken
      PID:1068
    • C:\Windows\SYSTEM32\mountvol.exe
      "mountvol" Z: /s
      2⤵
        PID:2212
      • C:\Windows\SYSTEM32\mountvol.exe
        "mountvol" Z: /d
        2⤵
        • Enumerates connected drives
        PID:3552
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x418 0x300
      1⤵
        PID:1688
      • C:\Users\Admin\AppData\Roaming\yhy.exe
        C:\Users\Admin\AppData\Roaming\yhy.exe
        1⤵
        • Executes dropped EXE
        PID:5840
      • C:\Users\Admin\AppData\Roaming\yhy.exe
        C:\Users\Admin\AppData\Roaming\yhy.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4816
        • C:\Windows\system32\schtasks.exe
          "schtasks.exe" /create /f /sc minute /mo 1 /tn "yhy" /tr "C:\Users\Admin\AppData\Roaming\yhy.exe"
          2⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4248
        • C:\Windows\system32\powercfg.exe
          "powercfg" /h off
          2⤵
          • Power Settings
          • Suspicious use of AdjustPrivilegeToken
          PID:4800
        • C:\Windows\system32\mountvol.exe
          "mountvol" Z: /s
          2⤵
            PID:4916
          • C:\Windows\system32\mountvol.exe
            "mountvol" Z: /d
            2⤵
            • Enumerates connected drives
            PID:5224
        • C:\Users\Admin\AppData\Roaming\yhy.exe
          C:\Users\Admin\AppData\Roaming\yhy.exe
          1⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4720
          • C:\Windows\system32\schtasks.exe
            "schtasks.exe" /create /f /sc minute /mo 1 /tn "yhy" /tr "C:\Users\Admin\AppData\Roaming\yhy.exe"
            2⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3552
          • C:\Windows\system32\powercfg.exe
            "powercfg" /h off
            2⤵
            • Power Settings
            • Suspicious use of AdjustPrivilegeToken
            PID:1208
          • C:\Windows\system32\mountvol.exe
            "mountvol" Z: /s
            2⤵
              PID:4272
            • C:\Windows\system32\mountvol.exe
              "mountvol" Z: /d
              2⤵
              • Enumerates connected drives
              PID:5164

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                yhy.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\yhy.exe.log
                • Size 42B
                • SHA256 d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
                • MD5 SHA1 SHA512
                Submit Download

                23a237af148443aaa2f3b81a33ea9571.wav
                • Path C:\Users\Admin\AppData\Local\Temp\23a237af148443aaa2f3b81a33ea9571.wav
                • Size 3.9MB
                • SHA256 0679c1a5e58477ddf695d74c4d683378ce53e7dbbb727197ac862c92ceb8e4f8
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                yhy.exe
                • Path C:\Users\Admin\AppData\Roaming\yhy.exe
                • Size 4.9MB
                • SHA256 b68ddd764e106845d08af6d1e13ef271e54e049c9e00d4171d5fded4e7338979
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/2580-0-0x0000000000040000-0x000000000051E000-memory.dmp
                Download

                memory/2580-2-0x0000000002630000-0x0000000002640000-memory.dmp
                Download