Analysis
- max time kernel
120s - max time network
172s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
03/02/2022, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe
- Size 1.7MB
- Sample220203-s6d78abdar
- SHA256 9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e
- MD5 3cef5f47f07f15094c9af0d6a9f9937d
- SHA1 8153f93a1b8dc86f8c48e49a1bafab797404da70
- SHA512 02d622020b0346040e78de301e351506f78b88a1daa7106ddf599a5eda331ab875fc7e364428336a6ea25fe3c0ef66016f2abccae1df0a6c3bb11e6cc7cab263
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 3204 explorer.exe 2712 WinRAR.4.11.x64.en.exe - Sets service image path in registry 2 TTPs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe - Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 4712 svchost.exe Token: SeCreatePagefilePrivilege 4712 svchost.exe Token: SeShutdownPrivilege 4712 svchost.exe Token: SeCreatePagefilePrivilege 4712 svchost.exe Token: SeShutdownPrivilege 4712 svchost.exe Token: SeCreatePagefilePrivilege 4712 svchost.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2712 WinRAR.4.11.x64.en.exe 2712 WinRAR.4.11.x64.en.exe 2712 WinRAR.4.11.x64.en.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3652 wrote to memory of 3204 3652 9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe 86 PID 3652 wrote to memory of 3204 3652 9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe 86 PID 3652 wrote to memory of 3204 3652 9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe 86 PID 3204 wrote to memory of 2068 3204 explorer.exe 88 PID 3204 wrote to memory of 2068 3204 explorer.exe 88 PID 3204 wrote to memory of 2068 3204 explorer.exe 88 PID 3652 wrote to memory of 2712 3652 9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe 89 PID 3652 wrote to memory of 2712 3652 9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe 89 PID 2068 wrote to memory of 2800 2068 fondue.exe 90 PID 2068 wrote to memory of 2800 2068 fondue.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe"C:\Users\Admin\AppData\Local\Temp\9dfe652042ebe64aff49368a5e7aeaaf2a5567adb056163dc2cea4cfe33da04e.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\explorer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\fondue.exe"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll3⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\system32\FonDUE.EXE"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll4⤵PID:2800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinRAR.4.11.x64.en.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\WinRAR.4.11.x64.en.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2712
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe c56acab7282025ec778be3f652a6978d r2dtYM9WgUOnPFR7WjSYAA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:2520
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4712