Overview
overview
10Static
static
NDt93WWQwd089H7.exe
windows7_x64
10NDt93WWQwd089H7.exe
windows10-2004_x64
4YyeznSFcE5IUYLS.exe
windows7_x64
10YyeznSFcE5IUYLS.exe
windows10-2004_x64
4w7a5Qzx6sR1WxLJ.exe
windows7_x64
1w7a5Qzx6sR1WxLJ.exe
windows10-2004_x64
10wCRnCAMZ3yT8BQ2.exe
windows7_x64
10wCRnCAMZ3yT8BQ2.exe
windows10-2004_x64
10Analysis
-
max time kernel
152s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
21-02-2022 11:06
Static task
static1
Behavioral task
behavioral1
Sample
NDt93WWQwd089H7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
NDt93WWQwd089H7.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
YyeznSFcE5IUYLS.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
YyeznSFcE5IUYLS.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral5
Sample
w7a5Qzx6sR1WxLJ.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
w7a5Qzx6sR1WxLJ.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
wCRnCAMZ3yT8BQ2.exe
Resource
win7-en-20211208
General
-
Target
YyeznSFcE5IUYLS.exe
-
Size
936KB
-
MD5
49ad4e42ac4829d60cb703811a951363
-
SHA1
d0deb06327fc6545177fabaaff9a14312a9e2d2c
-
SHA256
a5eb38594eb57ed5010a258b0f35aa3647243e8eb5ba4474eee9808abcaeb149
-
SHA512
7a144c931c1b313f4783c1b11e7df41ac1a893bfb80dce5942eb75e8b0e9533c3de7cf720444070df4d95dc730227e71b0542e769fc6a41e22008d901d141700
Malware Config
Signatures
-
Drops file in Windows directory 3 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 49 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4312" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132901203671586032" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4096" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "1.351393" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.976910" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "12.476684" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
TiWorker.exedescription pid process Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe Token: SeRestorePrivilege 2160 TiWorker.exe Token: SeSecurityPrivilege 2160 TiWorker.exe Token: SeBackupPrivilege 2160 TiWorker.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
YyeznSFcE5IUYLS.exefondue.exedescription pid process target process PID 3276 wrote to memory of 812 3276 YyeznSFcE5IUYLS.exe fondue.exe PID 3276 wrote to memory of 812 3276 YyeznSFcE5IUYLS.exe fondue.exe PID 3276 wrote to memory of 812 3276 YyeznSFcE5IUYLS.exe fondue.exe PID 812 wrote to memory of 3560 812 fondue.exe FonDUE.EXE PID 812 wrote to memory of 3560 812 fondue.exe FonDUE.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\YyeznSFcE5IUYLS.exe"C:\Users\Admin\AppData\Local\Temp\YyeznSFcE5IUYLS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\fondue.exe"C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll2⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\system32\FonDUE.EXE"C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll3⤵PID:3560
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2508
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4008