Windows Analysis Report
yoyo.exe

ID:	1546036
Product:	CloudBasic
Start time:	12:00:19
Start date:	31.10.2024
Sample:	yoyo.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0ced0787f8e64762035adea6c6aff9e2
SHA1:	3f3822cccdd892f20a8535a8137420e4e1b49344
SHA256:	79937a1b5c371c64c42abd995ddc3beff64be580f3f11ece7aceaccf1b306cee
Filetype:	Win64 Executable Console (202006/5) 92.65%

Name	Type	MD5	SHA1	SHA256
\Device\ConDrv	ASCII text, with CRLF line terminators	CAF0F008F51248BD8771E99EE040C51A	F92EFA13B109747BCB1726C52B16DAAC1091887F	2179C85F3082CDCCB0E59E8421FA8E83B13DD51DD540A5299E4AECC8149A0D11

Cryptography

Source: C:\Users\user\Desktop\yoyo.exe

Code function: 0_2_00007FF6BDD115E4 CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptDestroyHash,CryptReleaseContext,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,

0_2_00007FF6BDD115E4

Compliance

Source: yoyo.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Networking

Source: yoyo.exe

Static PE information: Found NDIS imports: FwpmEngineClose0, FwpmEngineOpen0, FwpmFilterAdd0, FwpmFilterCreateEnumHandle0, FwpmFilterDeleteById0, FwpmFilterDestroyEnumHandle0, FwpmFilterEnum0, FwpmFreeMemory0, FwpmProviderAdd0, FwpmProviderCreateEnumHandle0, FwpmProviderDeleteByKey0, FwpmProviderDestroyEnumHandle0, FwpmProviderEnum0

System Summary

Source: C:\Users\user\Desktop\yoyo.exe

Code function: 0_2_00007FF6BDD19170

0_2_00007FF6BDD19170

Source: C:\Users\user\Desktop\yoyo.exe

Code function: String function: 00007FF6BDD11550 appears 50 times

Source: yoyo.exe

Static PE information: Number of sections : 18 > 10

Source: classification engine

Classification label: sus24.troj.winEXE@6/3@0/0

Source: C:\Users\user\Desktop\yoyo.exe

Code function: 0_2_00007FF6BDD12AE8 GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,CloseHandle,GetLastError,CloseHandle,CloseHandle,

0_2_00007FF6BDD12AE8

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6052:120:WilError_03

Source: yoyo.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\yoyo.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: yoyo.exe	String found in binary or memory: --help
Source: yoyo.exe	String found in binary or memory: --help
Source: yoyo.exe	String found in binary or memory: --help
Source: yoyo.exe	String found in binary or memory: --help
Source: yoyo.exe	String found in binary or memory: 3DRS1l3nc3r.3xe unbl0ck <f1lt3r 1d>-h--helpblockedrblock[-] Missing second argument. Please provide the full path of the process to block.
Source: yoyo.exe	String found in binary or memory: 3DRS1l3nc3r.3xe unbl0ck <f1lt3r 1d>-h--helpblockedrblock[-] Missing second argument. Please provide the full path of the process to block.

Source: unknown	Process created: C:\Users\user\Desktop\yoyo.exe "C:\Users\user\Desktop\yoyo.exe" -install
Source: C:\Users\user\Desktop\yoyo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\yoyo.exe "C:\Users\user\Desktop\yoyo.exe" /install
Source: C:\Users\user\Desktop\yoyo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Desktop\yoyo.exe "C:\Users\user\Desktop\yoyo.exe" /load
Source: C:\Users\user\Desktop\yoyo.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\yoyo.exe	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\yoyo.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Users\user\Desktop\yoyo.exe	Section loaded: fwpuclnt.dll			Jump to behavior
Source: C:\Users\user\Desktop\yoyo.exe	Section loaded: fwpuclnt.dll			Jump to behavior

Source: yoyo.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: yoyo.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation

Source: yoyo.exe	Static PE information: section name: .xdata
Source: yoyo.exe	Static PE information: section name: /4
Source: yoyo.exe	Static PE information: section name: /19
Source: yoyo.exe	Static PE information: section name: /31
Source: yoyo.exe	Static PE information: section name: /45
Source: yoyo.exe	Static PE information: section name: /57
Source: yoyo.exe	Static PE information: section name: /70
Source: yoyo.exe	Static PE information: section name: /81
Source: yoyo.exe	Static PE information: section name: /92

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\yoyo.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\yoyo.exe

API coverage: 7.4 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\yoyo.exe

Code function: 0_2_00007FF6BDD11190 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,

0_2_00007FF6BDD11190