Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 02:01
Behavioral task
behavioral1
Sample
6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe
- Size 5.6MB
- Sample260803-cf2b3azzc1
- SHA256 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af
- MD5 203290f8e771a33a5b6d0272bbd25f17
- SHA1 c508eee65c35b4b001630b39ab945cca2f83eac3
- SHA512 58c691f1c2e9238cb52cef55a40f16251803f3652ec19d21d395d22307a4217c3d03c3a3fc80ad52052f82596fbdb645efb58c1f3a389a1a22d1e87e8298b0b8
- SSDEEP 98304:ccCF8jegsFasnjoLWfzBBy9LPl5/4n9tFvk32Xl72dyPtrGGhyeh/erFYhPFN3bc:ccccelzoLQs5e9tqakyvyGN3b5a
- TLSH T1EA4633461A8F9513C1BA6F781C5AE53D1FFC1B113C088BB2A84277C5E673AD4BE93198
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/4996-11-0x0000000000400000-0x00000000012A9000-memory.dmp vmprotect behavioral1/memory/4996-12-0x0000000000400000-0x00000000012A9000-memory.dmp vmprotect behavioral1/memory/4996-30-0x0000000000400000-0x00000000012A9000-memory.dmp vmprotect - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: Fondue.exe File opened (read-only) \??\M: Fondue.exe File opened (read-only) \??\O: Fondue.exe File opened (read-only) \??\R: Fondue.exe File opened (read-only) \??\Y: Fondue.exe File opened (read-only) \??\Z: Fondue.exe File opened (read-only) \??\A: Fondue.exe File opened (read-only) \??\B: Fondue.exe File opened (read-only) \??\H: Fondue.exe File opened (read-only) \??\P: Fondue.exe File opened (read-only) \??\Q: Fondue.exe File opened (read-only) \??\X: Fondue.exe File opened (read-only) \??\E: Fondue.exe File opened (read-only) \??\S: Fondue.exe File opened (read-only) \??\U: Fondue.exe File opened (read-only) \??\V: Fondue.exe File opened (read-only) \??\G: Fondue.exe File opened (read-only) \??\I: Fondue.exe File opened (read-only) \??\N: Fondue.exe File opened (read-only) \??\T: Fondue.exe File opened (read-only) \??\W: Fondue.exe File opened (read-only) \??\J: Fondue.exe File opened (read-only) \??\K: Fondue.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Fondue.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4996 set thread context of 3312 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 96 -
resource yara_rule behavioral1/memory/3312-22-0x0000000004400000-0x000000000449E000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Fondue.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Fondue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct Fondue.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2360 wmic.exe Token: SeSecurityPrivilege 2360 wmic.exe Token: SeTakeOwnershipPrivilege 2360 wmic.exe Token: SeLoadDriverPrivilege 2360 wmic.exe Token: SeSystemProfilePrivilege 2360 wmic.exe Token: SeSystemtimePrivilege 2360 wmic.exe Token: SeProfSingleProcessPrivilege 2360 wmic.exe Token: SeIncBasePriorityPrivilege 2360 wmic.exe Token: SeCreatePagefilePrivilege 2360 wmic.exe Token: SeBackupPrivilege 2360 wmic.exe Token: SeRestorePrivilege 2360 wmic.exe Token: SeShutdownPrivilege 2360 wmic.exe Token: SeDebugPrivilege 2360 wmic.exe Token: SeSystemEnvironmentPrivilege 2360 wmic.exe Token: SeRemoteShutdownPrivilege 2360 wmic.exe Token: SeUndockPrivilege 2360 wmic.exe Token: SeManageVolumePrivilege 2360 wmic.exe Token: 33 2360 wmic.exe Token: 34 2360 wmic.exe Token: 35 2360 wmic.exe Token: 36 2360 wmic.exe Token: SeIncreaseQuotaPrivilege 2360 wmic.exe Token: SeSecurityPrivilege 2360 wmic.exe Token: SeTakeOwnershipPrivilege 2360 wmic.exe Token: SeLoadDriverPrivilege 2360 wmic.exe Token: SeSystemProfilePrivilege 2360 wmic.exe Token: SeSystemtimePrivilege 2360 wmic.exe Token: SeProfSingleProcessPrivilege 2360 wmic.exe Token: SeIncBasePriorityPrivilege 2360 wmic.exe Token: SeCreatePagefilePrivilege 2360 wmic.exe Token: SeBackupPrivilege 2360 wmic.exe Token: SeRestorePrivilege 2360 wmic.exe Token: SeShutdownPrivilege 2360 wmic.exe Token: SeDebugPrivilege 2360 wmic.exe Token: SeSystemEnvironmentPrivilege 2360 wmic.exe Token: SeRemoteShutdownPrivilege 2360 wmic.exe Token: SeUndockPrivilege 2360 wmic.exe Token: SeManageVolumePrivilege 2360 wmic.exe Token: 33 2360 wmic.exe Token: 34 2360 wmic.exe Token: 35 2360 wmic.exe Token: 36 2360 wmic.exe Token: SeDebugPrivilege 3312 Fondue.exe Token: SeDebugPrivilege 3312 Fondue.exe Token: SeDebugPrivilege 3312 Fondue.exe Token: SeDebugPrivilege 3312 Fondue.exe Token: 33 3312 Fondue.exe Token: SeIncBasePriorityPrivilege 3312 Fondue.exe Token: 33 3312 Fondue.exe Token: SeIncBasePriorityPrivilege 3312 Fondue.exe Token: 33 3312 Fondue.exe Token: SeIncBasePriorityPrivilege 3312 Fondue.exe Token: 33 3312 Fondue.exe Token: SeIncBasePriorityPrivilege 3312 Fondue.exe Token: 33 3312 Fondue.exe Token: SeIncBasePriorityPrivilege 3312 Fondue.exe Token: 33 3312 Fondue.exe Token: SeIncBasePriorityPrivilege 3312 Fondue.exe Token: 33 3312 Fondue.exe Token: SeIncBasePriorityPrivilege 3312 Fondue.exe Token: 33 3312 Fondue.exe Token: SeIncBasePriorityPrivilege 3312 Fondue.exe Token: 33 3312 Fondue.exe Token: SeIncBasePriorityPrivilege 3312 Fondue.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3312 Fondue.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3312 Fondue.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 3312 Fondue.exe 3312 Fondue.exe 3312 Fondue.exe - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4996 wrote to memory of 3760 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 85 PID 4996 wrote to memory of 4332 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 86 PID 4996 wrote to memory of 4164 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 87 PID 4996 wrote to memory of 764 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 88 PID 4996 wrote to memory of 3456 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 89 PID 4996 wrote to memory of 1432 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 90 PID 4996 wrote to memory of 1940 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 91 PID 4996 wrote to memory of 3372 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 92 PID 4996 wrote to memory of 2080 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 93 PID 4996 wrote to memory of 1672 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 94 PID 4996 wrote to memory of 1164 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 95 PID 4996 wrote to memory of 3312 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 96 PID 4996 wrote to memory of 3312 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 96 PID 4996 wrote to memory of 3312 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 96 PID 4996 wrote to memory of 3312 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 96 PID 4996 wrote to memory of 3312 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 96 PID 4996 wrote to memory of 3312 4996 6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe 96 PID 3312 wrote to memory of 2360 3312 Fondue.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe"C:\Users\Admin\AppData\Local\Temp\6c6973022c7e07aaff808938ab979899f13a551ed083a17a52866ecd050168af.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\RunLegacyCPLElevated.exeRunLegacyCPLElevated.exe2⤵PID:3760
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exebackgroundTaskHost.exe2⤵PID:4332
-
-
C:\Windows\SysWOW64\print.exeprint.exe2⤵PID:4164
-
-
C:\Windows\SysWOW64\winrshost.exewinrshost.exe2⤵PID:764
-
-
C:\Windows\SysWOW64\Dism.exeDism.exe2⤵PID:3456
-
-
C:\Windows\SysWOW64\agentactivationruntimestarter.exeagentactivationruntimestarter.exe2⤵PID:1432
-
-
C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exeSystemPropertiesDataExecutionPrevention.exe2⤵PID:1940
-
-
C:\Windows\SysWOW64\SystemPropertiesHardware.exeSystemPropertiesHardware.exe2⤵PID:3372
-
-
C:\Windows\SysWOW64\mstsc.exemstsc.exe2⤵PID:2080
-
-
C:\Windows\SysWOW64\mfpmp.exemfpmp.exe2⤵PID:1672
-
-
C:\Windows\SysWOW64\RMActivate_ssp.exeRMActivate_ssp.exe2⤵PID:1164
-
-
C:\Windows\SysWOW64\Fondue.exeFondue.exe2⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic baseboard get serialnumber3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-