squirrelwaffle | 9c4807666747c9befea4427e5b9791193fdb105d53400639e8cc401d92463be2

Resubmissions

01-11-2021 12:31

211101-pp5r3ahha4 10

31-10-2021 09:03

211031-k1bwxacfaq 10

14-10-2021 01:44

211014-b6aflafeg4 10

Analysis

max time kernel
602s
max time network
608s
platform
windows11_x64
resource
win11
submitted
01-11-2021 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b.dll
Size

235KB
MD5

8e37795097400f6a609525749d154cd0
SHA1

8e1502c2aa56e6a8c7c1d2c75f3946332a5bb8c0
SHA256

6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b
SHA512

c7453b8f50e557a5990ac3708931845eeb6dc2992cd907d5534733524f523226d8d013be6e09bb2b5210f6f5ad2303625f8998a5111d3b0925bb4228b6c9152a

Score

10^/10

squirrelwaffle downloader persistence

Malware Config

Extracted

Family

squirrelwaffle

http://acdlimited.com/2u6aW9Pfe

http://jornaldasoficinas.com/ZF8GKIGVDupL

http://orldofjain.com/lMsTA7tSYpe

http://altayaralsudani.net/SSUsPgb7PHgC

http://hoteloaktree.com/QthLWsZsVgb

http://aterwellnessinc.com/U7D0sswwp

http://sirifinco.com/Urbhq9wO50j

http://ordpress17.com/5WG6Z62sKWo

http://mohsinkhanfoundation.com/pcQLeLMbur

http://lendbiz.vn/xj3BhHtMbf

http://geosever.rs/ObHP1CHt

http://nuevainfotech.com/xCNyTjzkoe

http://dadabhoy.pk/m6rQE94U

http://111

http://sjgrand.lk/zvMYuQqEZj

http://erogholding.com/GFM1QcCFk

http://armordetailing.rs/lgfrZb4Re6WO

http://lefrenchwineclub.com/eRUGdDox

Signatures

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle

Squirrelwaffle Payload 2 IoCs

Processes:

resource	yara_rule
behavioral13/memory/800-159-0x0000000010000000-0x0000000010010000-memory.dmp	squirrelwaffle
behavioral13/memory/800-160-0x0000000010000000-0x00000000100D6000-memory.dmp	squirrelwaffle

Blocklisted process makes network request 22 IoCs

Processes:

rundll32.exe

flow	pid	process
44	800	rundll32.exe
45	800	rundll32.exe
46	800	rundll32.exe
47	800	rundll32.exe
48	800	rundll32.exe
49	800	rundll32.exe
53	800	rundll32.exe
54	800	rundll32.exe
55	800	rundll32.exe
56	800	rundll32.exe
57	800	rundll32.exe
58	800	rundll32.exe
59	800	rundll32.exe
60	800	rundll32.exe
61	800	rundll32.exe
62	800	rundll32.exe
63	800	rundll32.exe
64	800	rundll32.exe
65	800	rundll32.exe
66	800	rundll32.exe
67	800	rundll32.exe
68	800	rundll32.exe

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

WaaSMedicAgent.exesvchost.exeWaaSMedicAgent.exeWaaSMedicAgent.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exesvchost.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	1872	svchost.exe
Token: SeCreatePagefilePrivilege	1872	svchost.exe
Token: SeShutdownPrivilege	1872	svchost.exe
Token: SeCreatePagefilePrivilege	1872	svchost.exe
Token: SeShutdownPrivilege	1872	svchost.exe
Token: SeCreatePagefilePrivilege	1872	svchost.exe
Token: SeShutdownPrivilege	952	svchost.exe
Token: SeCreatePagefilePrivilege	952	svchost.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe
Token: SeSecurityPrivilege	2276	TiWorker.exe
Token: SeBackupPrivilege	2276	TiWorker.exe
Token: SeRestorePrivilege	2276	TiWorker.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

rundll32.exesvchost.exe

description	pid	process	target process
PID 3996 wrote to memory of 800	3996	rundll32.exe	rundll32.exe
PID 3996 wrote to memory of 800	3996	rundll32.exe	rundll32.exe
PID 3996 wrote to memory of 800	3996	rundll32.exe	rundll32.exe
PID 952 wrote to memory of 3032	952	svchost.exe	MoUsoCoreWorker.exe
PID 952 wrote to memory of 3032	952	svchost.exe	MoUsoCoreWorker.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3996

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6402b33d729c8bb44881747a8f397f4aec408bf5e18b9af6fd86cdfa3f96323b.dll,#1
2⤵
- Blocklisted process makes network request
PID:800

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe bfdc34d7c1ee0bda183cb386fc7ee697 llqiexvWSEukRqw/O0OCUQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:952

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:3032

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2276

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe bfdc34d7c1ee0bda183cb386fc7ee697 llqiexvWSEukRqw/O0OCUQ.0.1.0.3.0
1⤵
PID:1620

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe bfdc34d7c1ee0bda183cb386fc7ee697 llqiexvWSEukRqw/O0OCUQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:3312

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe bfdc34d7c1ee0bda183cb386fc7ee697 llqiexvWSEukRqw/O0OCUQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:5072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/800-146-0x0000000000000000-mapping.dmp

Download
memory/800-160-0x0000000010000000-0x00000000100D6000-memory.dmp

Filesize
856KB

Download
memory/800-159-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/800-158-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

Filesize
4KB

Download
memory/800-157-0x0000000010000000-0x00000000100D6000-memory.dmp

Filesize
856KB

Download
memory/1872-152-0x000001C0B97C0000-0x000001C0B97C1000-memory.dmp

Filesize
4KB

Download
memory/1872-151-0x000001C0B97D0000-0x000001C0B97D4000-memory.dmp

Filesize
16KB

Download
memory/1872-153-0x000001C0B9FB0000-0x000001C0B9FB4000-memory.dmp

Filesize
16KB

Download
memory/1872-154-0x000001C0B9FA0000-0x000001C0B9FA1000-memory.dmp

Filesize
4KB

Download
memory/1872-155-0x000001C0BA480000-0x000001C0BA484000-memory.dmp

Filesize
16KB

Download
memory/1872-156-0x000001C0BA3D0000-0x000001C0BA3D1000-memory.dmp

Filesize
4KB

Download
memory/1872-149-0x000001C0B9640000-0x000001C0B9644000-memory.dmp

Filesize
16KB

Download
memory/1872-148-0x000001C0B70E0000-0x000001C0B70F0000-memory.dmp

Filesize
64KB

Download
memory/1872-147-0x000001C0B6960000-0x000001C0B6970000-memory.dmp

Filesize
64KB

Download
memory/3032-150-0x0000000000000000-mapping.dmp

Download