a8dd3a48eb0b910745c152eb6e85bcc904a6cd3d932d2252d5c5fc914357aa21

Analysis

max time kernel
189s
max time network
216s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2022, 20:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

waefa.exe
Size

18KB
MD5

4bbe1f613170a3f6e7dc180bc9a8adef
SHA1

d4244683a40752b2ed8b1c8147f2bcfc3cbcffe0
SHA256

f23489dc6c2ac89afe8fa6ac66c9f7f539edd74abb1c04b21da4af33a2046fbc
SHA512

60119f3cf59ab5f02c6af6300c27a32f4ecfa5ed35826144894787a756f718a4851060422ce2719f66fd7c3b7e41b198f153dddb4b9e1290f3dc8146858ee296
SSDEEP

192:D4HammBJulY8NaszNnuj0ucxyzLorKglJr9weFnjm1VbBxGsVZ3HR17wglj:D+mBJb8N5NujRmHr9Ppm1RBxGAh177l

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1880	lsass.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	waefa.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe	waefa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe	waefa.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1880	4916	waefa.exe	81
PID 4916 wrote to memory of 1880	4916	waefa.exe	81
PID 4916 wrote to memory of 1880	4916	waefa.exe	81

C:\Users\Admin\AppData\Local\Temp\waefa.exe
"C:\Users\Admin\AppData\Local\Temp\waefa.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"
  2⤵
  - Executes dropped EXE
  - Drops startup file
  PID:1880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe

Filesize
18KB

MD5
4bbe1f613170a3f6e7dc180bc9a8adef

SHA1
d4244683a40752b2ed8b1c8147f2bcfc3cbcffe0

SHA256
f23489dc6c2ac89afe8fa6ac66c9f7f539edd74abb1c04b21da4af33a2046fbc

SHA512
60119f3cf59ab5f02c6af6300c27a32f4ecfa5ed35826144894787a756f718a4851060422ce2719f66fd7c3b7e41b198f153dddb4b9e1290f3dc8146858ee296

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe

Filesize
18KB

MD5
4bbe1f613170a3f6e7dc180bc9a8adef

SHA1
d4244683a40752b2ed8b1c8147f2bcfc3cbcffe0

SHA256
f23489dc6c2ac89afe8fa6ac66c9f7f539edd74abb1c04b21da4af33a2046fbc

SHA512
60119f3cf59ab5f02c6af6300c27a32f4ecfa5ed35826144894787a756f718a4851060422ce2719f66fd7c3b7e41b198f153dddb4b9e1290f3dc8146858ee296

Download Submit