Overview
overview
10Static
static
yhhljgxudq...db.dll
windows7_x64
1yhhljgxudq...db.dll
windows10-2004_x64
8yhhljgxudq...UI.dll
windows7_x64
1yhhljgxudq...UI.dll
windows10-2004_x64
8yhhljgxudq...og.ps1
windows7_x64
1yhhljgxudq...og.ps1
windows10-2004_x64
1yhhljgxudq...ss.exe
windows7_x64
3yhhljgxudq...ss.exe
windows10-2004_x64
8yhhljgxudq...e3.dll
windows7_x64
3yhhljgxudq...e3.dll
windows10-2004_x64
10yhhljgxudq...it.exe
windows7_x64
1yhhljgxudq...it.exe
windows10-2004_x64
8Analysis
-
max time kernel
40s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
01-02-2022 20:24
Static task
static1
Behavioral task
behavioral1
Sample
yhhljgxudqeyowcinyde44154280653/db.dll
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral2
Sample
yhhljgxudqeyowcinyde44154280653/db.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral3
Sample
yhhljgxudqeyowcinyde44154280653/db/userinitUI.dll
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral4
Sample
yhhljgxudqeyowcinyde44154280653/db/userinitUI.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral5
Sample
yhhljgxudqeyowcinyde44154280653/log.ps1
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral6
Sample
yhhljgxudqeyowcinyde44154280653/log.ps1
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral7
Sample
yhhljgxudqeyowcinyde44154280653/smss.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral8
Sample
yhhljgxudqeyowcinyde44154280653/smss.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral9
Sample
yhhljgxudqeyowcinyde44154280653/sqlite3.dll
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral10
Sample
yhhljgxudqeyowcinyde44154280653/sqlite3.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral11
Sample
yhhljgxudqeyowcinyde44154280653/userinit.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral12
Sample
yhhljgxudqeyowcinyde44154280653/userinit.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
General
-
Target
yhhljgxudqeyowcinyde44154280653/db.dll
-
Size
952KB
-
MD5
64dc543f839f52eb26f658585332b48b
-
SHA1
1207a7232c78c381cb6bacfa3d5485df2b5e59d3
-
SHA256
cd7d5c9b8ce5d3d51a813a8e957fbfbfde426f159aa584937e35a8e057b24c8e
-
SHA512
eb3f427e6a6ee3b4525f44ac412a2b4c64b76ac3efdaa0c2fa3f0dfbe5a1afd7052f78691ebd54c2cc0dcff02a3655b9e75b9d6de46a1bac4db38d1770e7512a
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4504 set thread context of 364 4504 rundll32.exe 87 -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 4896 svchost.exe Token: SeCreatePagefilePrivilege 4896 svchost.exe Token: SeShutdownPrivilege 4896 svchost.exe Token: SeCreatePagefilePrivilege 4896 svchost.exe Token: SeShutdownPrivilege 4896 svchost.exe Token: SeCreatePagefilePrivilege 4896 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3392 wrote to memory of 4504 3392 rundll32.exe 82 PID 3392 wrote to memory of 4504 3392 rundll32.exe 82 PID 3392 wrote to memory of 4504 3392 rundll32.exe 82 PID 4504 wrote to memory of 4500 4504 rundll32.exe 83 PID 4504 wrote to memory of 4500 4504 rundll32.exe 83 PID 4504 wrote to memory of 4500 4504 rundll32.exe 83 PID 4504 wrote to memory of 4500 4504 rundll32.exe 83 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87 PID 4504 wrote to memory of 364 4504 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\yhhljgxudqeyowcinyde44154280653\db.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\yhhljgxudqeyowcinyde44154280653\db.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"3⤵PID:4500
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\System32\svchost.exe"3⤵PID:364
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 5b6c16b767648cbf303f0392125451d8 DtzYR4PCy0KeC6s7UGGf8A.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:1340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4896