Analysis

  • max time kernel
    155s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    01-02-2022 12:56

General

  • Target

    0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e.exe

  • Size

    16KB

  • MD5

    99250e771feb3b70e4122bbc54a79f8e

  • SHA1

    432d8117bc544918bdaecc01c6ce68305cfd2e86

  • SHA256

    0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e

  • SHA512

    6f0bc3b1c7a73009d1ca71a3ad08fcf76d66e32e25cba9d7a547e95b178b1d5dd4699c07beb49add607063513c37158809ed640e1deb9011265b1bdf9f7fd284

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs
  • Drops file in Windows directory 6 IoCs
  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e.exe
    "C:\Users\Admin\AppData\Local\Temp\0b3ca8fc417a9e5ac4101babf092999399fe7aadc4d8b68b4707e8297db0a08e.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Windows\system32\fondue.exe
      "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
      2⤵
        PID:4060
    • C:\Windows\System32\WaaSMedicAgent.exe
      C:\Windows\System32\WaaSMedicAgent.exe 4ded444f0eef8aa075c8681b0406ee9d RtQv6Go+EUmv1nsbgWwDXw.0.1.0.0.0
      1⤵
      • Modifies data under HKEY_USERS
      PID:4840
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:4488

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4488-130-0x0000018C02530000-0x0000018C02540000-memory.dmp
      Filesize

      64KB

    • memory/4488-131-0x0000018C02590000-0x0000018C025A0000-memory.dmp
      Filesize

      64KB

    • memory/4488-132-0x0000018C052B0000-0x0000018C052B4000-memory.dmp
      Filesize

      16KB