eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
Size

61KB
MD5

8a61c22d925e58ba50b7f19ea1a61608
SHA1

da1f37ed710aa5a242b1f7514354921c133d3aa0
SHA256

eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647
SHA512

e63b8135685b7e1934977881cf91e2b125b3031edb94281cfa8d9b904ea44ae472a9ae5c710a7a1c1321b6e92cc4e199c8477b41a3ca2f8bf1b4489c70a6eb10
SSDEEP

1536:y4QQ6NSyM61l19piO+LV8YEoI/EU9RUe4m0NFDu:y4X6NSyfnpijeYEoIcq44

Score

8^/10

persistence upx

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p"	WaaSMedicAgent.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4884-0-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral2/files/0x0003000000022d25-6.dat	upx
behavioral2/memory/4884-28-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral2/memory/4884-29-0x0000000000400000-0x0000000000464000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winxcfg.exe = "C:\\Windows\\system32\\winxcfg.exe"	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winxcfg.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\password stealer.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\msncracker.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\Norton antivirus 2002.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\AOL.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\fetish bondage preteen porno.mpg.pif	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\illgal incest preteen porn cum.mpg.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\aol password cracker.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\Hacking Tool Collection.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\play station emulator crack.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\Bondage Fetish Foot Cum.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\MSN.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\hotmail account sniffer.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\Preteen Rape Sex Illegal - Jenny - 13 Years old.mpg.pif	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\windows xp key generator and cracker.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\Winzip.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\Windows 2000.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\Xbox Iso 2 Rom Converter.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\win2k serial.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\pamela anderson naked.mpg.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\kill osama bin laden game.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\Play Games Online For FREE.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\12 year old forced rape cum.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\Website Hacker.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\Grand theft auto 3 CD1 crack.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\porn account cracker.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
File created	C:\Windows\SysWOW64\macromd\MSN Password Hacker and Stealer.exe	eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe
"C:\Users\Admin\AppData\Local\Temp\eeb247b749df201f1508a6106335c471dbdc0505ca2cd92eb631b76d63ff0647.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:4884

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 7538a2f3e625f55c1baea1eb46e252d0 63aft7S5gEy89N64R+gU1A.0.1.0.0.0
1⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3896 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\macromd\msncracker.exe

Filesize
74KB

MD5
3b1c1dc68f3e87aa724b8310e37ddc33

SHA1
cd1ac5b3220d0001b60a5fa9d7d83a32001f33d5

SHA256
4f13e109f0cd74901860c6bf46ae8ab848668e5cf748f3014d208c9be932310b

SHA512
aed231b08ea823c4655ab742ded6b5ebb6f131f39953db4f442a84c8a420f917a3311c710f741e64fcb8b789079bfe761de8f385f4d64bf2feb4fa04f85f3365

Download Submit
memory/4884-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4884-28-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4884-29-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads