Analysis
- max time kernel
138s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
01/02/2022, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe
- Size 160KB
- Sample220201-c4kdfsfdfq
- SHA256 f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91
- MD5 fa34cccf1e3bc991150b93e6d88c343f
- SHA1 bd399018689d3410784121f3a54d09486f747e27
- SHA512 0659decd2b4302b930cb768f36224d8251c0dbb9250f437f823b749016e251e39e8f3ff02a5e660584e40c6c79ede0483bb7a298b2d73dcb210d59cd7b14d83c
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
- Sets service image path in registry 2 TTPs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\F: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\I: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\L: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\R: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\X: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\E: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\Q: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\T: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\W: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\N: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\O: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\V: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\Y: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\B: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\G: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\H: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\M: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\Z: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\S: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\A: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\J: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\K: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe File opened (read-only) \??\P: f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3596 f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe 3596 f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3596 wrote to memory of 1612 3596 f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe 52 PID 3596 wrote to memory of 1612 3596 f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe 52 PID 3596 wrote to memory of 1612 3596 f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe"C:\Users\Admin\AppData\Local\Temp\f402a9ec5c591f5aec5177bdd33794319ac3e69fd31dd553e80db9824c09ae91.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵PID:1612
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 1881b767e5922fc5f3823e19b728845a O/t/vqmvr0W6dqZWOuA7UQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:2692