007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2

Resubmissions

04/11/2026, 16:57

261104-vgfqvsys7k10

01/02/2022, 08:40

220201-kk2sdsbfan10

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
01/02/2022, 08:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe
Size 728KB
Sample220201-kk2sdsbfan
SHA256 007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2
MD5 3867aff469391fba964309a4ba7a8ca2
SHA1 e2a224ef5764f4b34b51abbc0ada10ea1d0dc0a9
SHA512 73b56d1c9301dc9f385b99653c059c418ca633d51282affdad72be34d2b68022612ead62207cce353cb79304b5e48d79ae609264522519bb8efe38f2bf7f0b8a
MD5 SHA1 SHA512

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\__________WHY FILES NOT WORK__________.txt

Ransom Note

Attention! Your network has been compromised and all of your files has been encrytped by "Hydra Ransomware" team! We used nextgen strong cryptography in order to encrypt your files. The only way to restore your files is to buy decryptor! * You must know the worst thing is happened now and you cannot hide our successful attack! Understand if payment is not made on time. All your company data will be permanently destroyed. Your backups has been fatal and it is just a waste of your precious time if going to try them! * IF YOU UNDERSTAND THE SITUATION, FOLLOW THE RECOVERY INSTRUCTIONS BELOW 1. Copy your Network ID and send to our email. Network ID : DM5V6T52K4 Email : [email protected] 2. You will receive a amount and payment order. 3. We will send you decryptor with private key to recovery your files. * You can ask for 1 free file decryption as proof of work in the first correspondence! * Your time for save your files has limited to one week (from first impact) before we delete our temporary email address! * Data manipulation cause permanent loss of files!

Emails

[email protected]

Signatures

Sets service image path in registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3544	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe
3020	007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 3252	3020	007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe	64
PID 3020 wrote to memory of 3252	3020	007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe	64
PID 3020 wrote to memory of 3252	3020	007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe	64
PID 3252 wrote to memory of 3544	3252	cmd.exe	66
PID 3252 wrote to memory of 3544	3252	cmd.exe	66
PID 3252 wrote to memory of 3544	3252	cmd.exe	66

C:\Users\Admin\AppData\Local\Temp\007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe
"C:\Users\Admin\AppData\Local\Temp\007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C ping 127.0.0.1 -n 5 > NUL && del /Q /F "C:\Users\Admin\AppData\Local\Temp\007b5f204f5adfa631bab173a413a849da6d36cb198e9112777facdd090258f2.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:3544

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe b2fbb1c830cda85b9ef0d773fbecd442 7s8fIIQQMEmz3ID6MaZggQ.0.1.0.0.0
1⤵
- Modifies data under HKEY_USERS
PID:3816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads