Analysis
-
max time kernel
159s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
01-02-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
MAILPRIN.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
MAILPRIN.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
MAILPRIN.exe
-
Size
3.6MB
-
MD5
f3657fe3d3aa2264fc487d7d2e35a06a
-
SHA1
85c5b30ebe711953857cc6d5e5c52dc51786c518
-
SHA256
0232fe4b3256a6a4700de482e5e9074baf4548d7604cf4404182be73353ee32f
-
SHA512
f4a1186373821716e75b85405d7e31938902e9d1774d5c897f16baeb31bb0d227406011e6e462875c4a29ebbd85961213b98c780bf80a0e4a54bbbde61236cf4
Score
10/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobessl.exe DllHost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\adobessl.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe 3720 MAILPRIN.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58 PID 3720 wrote to memory of 2068 3720 MAILPRIN.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\MAILPRIN.exe"C:\Users\Admin\AppData\Local\Temp\MAILPRIN.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\calc.execalc.exe2⤵PID:2068
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe c3abd6ac3c9f7c7fe05233c8e41e72c1 iwcKAVX9dECi9IrcowxtpQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3624
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:1596