46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
129s
max time network
78s
platform
windows7_x64
resource
win7
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/27601d095e5b3761d9289584415a73cc.exe

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

WombatStarter.exeHPWombatSrv.exeWombatStarter.exe

pid process

872 WombatStarter.exe
1428 HPWombatSrv.exe
1108 WombatStarter.exe

pid	process
872	WombatStarter.exe
1428	HPWombatSrv.exe
1108	WombatStarter.exe

Loads dropped DLL 13 IoCs

Processes:

27601d095e5b3761d9289584415a73cc.exeHPWombatSrv.exe

pid	process
1100	27601d095e5b3761d9289584415a73cc.exe
1100	27601d095e5b3761d9289584415a73cc.exe
1428	HPWombatSrv.exe
1428	HPWombatSrv.exe
1428	HPWombatSrv.exe
1428	HPWombatSrv.exe
1428	HPWombatSrv.exe
1428	HPWombatSrv.exe
1428	HPWombatSrv.exe
1428	HPWombatSrv.exe
1100	27601d095e5b3761d9289584415a73cc.exe
1100	27601d095e5b3761d9289584415a73cc.exe
1100	27601d095e5b3761d9289584415a73cc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 8 IoCs

Processes:

27601d095e5b3761d9289584415a73cc.exe

description	ioc	process
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\3.ico	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\4.ico	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\5.ico	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\HPWombatSrv.exe	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\WombatStarter.exe	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\uninstaller.exe	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\1.ico	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\2.ico	27601d095e5b3761d9289584415a73cc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 3 IoCs

Processes:

HPWombatSrv.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	HPWombatSrv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet."	HPWombatSrv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\24\52C64B7E\@"%windir%\System32\ie4uinit.exe",-738 = "Start Internet Explorer without ActiveX controls or browser extensions."	HPWombatSrv.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

27601d095e5b3761d9289584415a73cc.exe

pid process

1100 27601d095e5b3761d9289584415a73cc.exe
1100 27601d095e5b3761d9289584415a73cc.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

27601d095e5b3761d9289584415a73cc.exe

description	pid	process	target process
PID 1100 wrote to memory of 872	1100	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 1100 wrote to memory of 872	1100	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 1100 wrote to memory of 872	1100	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 1100 wrote to memory of 872	1100	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 1100 wrote to memory of 1108	1100	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 1100 wrote to memory of 1108	1100	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 1100 wrote to memory of 1108	1100	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 1100 wrote to memory of 1108	1100	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe

C:\Users\Admin\AppData\Local\Temp\foo\27601d095e5b3761d9289584415a73cc.exe
"C:\Users\Admin\AppData\Local\Temp\foo\27601d095e5b3761d9289584415a73cc.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1100

C:\Program Files (x86)\HPWombat\WombatStarter.exe
"C:\Program Files (x86)\HPWombat\WombatStarter.exe" "install_and_start_srv" "C:\Users\Admin\AppData\Local\Temp\foo\27601d095e5b3761d9289584415a73cc.exe"
2⤵
- Executes dropped EXE
PID:872

C:\Program Files (x86)\HPWombat\WombatStarter.exe
"C:\Program Files (x86)\HPWombat\WombatStarter.exe" "write_patch_str_to_reg" "C:\Users\Admin\AppData\Local\Temp\foo\27601d095e5b3761d9289584415a73cc.exe" "HKLM" Software\HPWombat "jeromu"
2⤵
- Executes dropped EXE
PID:1108

C:\Program Files (x86)\HPWombat\HPWombatSrv.exe
"C:\Program Files (x86)\HPWombat\HPWombatSrv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:1428

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\HPWombat\HPWombatSrv.exe
MD5
bac2e4856879885af0251cb4cbb3d521

SHA1
a8d3f6492e20e775c84f16a8ca6683a2c1aabc2d

SHA256
18dd7fe65140120d10004e475effb1ce386d8f280094429f4654882120899d73

SHA512
5d550a67764a54145808a12953435a5dd75d1bea8200f2872e288f1eb9f8c0b798db539289950b2c42a0cac4a55689fc65427d1c97afdf83a10881a74d7a1935

Download Submit
C:\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
C:\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
C:\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Program Files (x86)\HPWombat\WombatStarter.exe
MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Users\Admin\AppData\Local\Temp\nsf39F5.tmp\inetc.dll
MD5
0f70de5c22874df2323f937f7b588bd4

SHA1
ed306624cd687d9e506c7ecd2ac97b7aaf556ff6

SHA256
7f5429361e0195d599ee05643e26985490b2ad85a08943e561898db3b365997b

SHA512
9cc23c1c5fbd07d991adf002fcdfdc3118b5d3648ac2387ef255ddd1377e1f94926f6e466ffe61657858df8e50179f52d647c75637beb2cd833b4ee6e5dc556e

Download Submit
\Users\Admin\AppData\Local\Temp\nsf39F5.tmp\nsProcess.dll
MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
memory/872-2-0x0000000000000000-mapping.dmp

Download
memory/1108-16-0x0000000000000000-mapping.dmp

Download
memory/1836-19-0x000007FEF7920000-0x000007FEF7B9A000-memory.dmp

Filesize
2.5MB

Download