46dc49be65d7165e2a6009854a4f27f0088230199e61e0555cb1bd266535874a

Analysis

max time kernel
147s
max time network
85s
platform
windows10_x64
resource
win10v200722
submitted
11-08-2020 12:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

foo/27601d095e5b3761d9289584415a73cc.exe

Score

8^/10

discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

WombatStarter.exeHPWombatSrv.exeWombatStarter.exe

pid process

1804 WombatStarter.exe
564 HPWombatSrv.exe
3160 WombatStarter.exe
Loads dropped DLL 3 IoCs

Processes:

27601d095e5b3761d9289584415a73cc.exe

pid process

836 27601d095e5b3761d9289584415a73cc.exe
836 27601d095e5b3761d9289584415a73cc.exe
836 27601d095e5b3761d9289584415a73cc.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1804	WombatStarter.exe
564	HPWombatSrv.exe
3160	WombatStarter.exe

Drops file in Program Files directory 8 IoCs

Processes:

27601d095e5b3761d9289584415a73cc.exe

description	ioc	process
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\3.ico	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\4.ico	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\5.ico	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\HPWombatSrv.exe	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\WombatStarter.exe	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\uninstaller.exe	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\1.ico	27601d095e5b3761d9289584415a73cc.exe
File created	C:\Program Files (x86)\HPWombat\Resources\Icons\Browsers\2.ico	27601d095e5b3761d9289584415a73cc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

Processes:

HPWombatSrv.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	HPWombatSrv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet."	HPWombatSrv.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

27601d095e5b3761d9289584415a73cc.exe

pid	process
836	27601d095e5b3761d9289584415a73cc.exe
836	27601d095e5b3761d9289584415a73cc.exe
836	27601d095e5b3761d9289584415a73cc.exe
836	27601d095e5b3761d9289584415a73cc.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

27601d095e5b3761d9289584415a73cc.exe

description	pid	process	target process
PID 836 wrote to memory of 1804	836	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 836 wrote to memory of 1804	836	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 836 wrote to memory of 1804	836	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 836 wrote to memory of 3160	836	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 836 wrote to memory of 3160	836	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe
PID 836 wrote to memory of 3160	836	27601d095e5b3761d9289584415a73cc.exe	WombatStarter.exe

C:\Users\Admin\AppData\Local\Temp\foo\27601d095e5b3761d9289584415a73cc.exe
"C:\Users\Admin\AppData\Local\Temp\foo\27601d095e5b3761d9289584415a73cc.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:836
- C:\Program Files (x86)\HPWombat\WombatStarter.exe
  "C:\Program Files (x86)\HPWombat\WombatStarter.exe" "install_and_start_srv" "C:\Users\Admin\AppData\Local\Temp\foo\27601d095e5b3761d9289584415a73cc.exe"
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Program Files (x86)\HPWombat\WombatStarter.exe
  "C:\Program Files (x86)\HPWombat\WombatStarter.exe" "write_patch_str_to_reg" "C:\Users\Admin\AppData\Local\Temp\foo\27601d095e5b3761d9289584415a73cc.exe" "HKLM" Software\HPWombat "jeromu"
  2⤵
  - Executes dropped EXE
  PID:3160

C:\Program Files (x86)\HPWombat\HPWombatSrv.exe
"C:\Program Files (x86)\HPWombat\HPWombatSrv.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\HPWombat\HPWombatSrv.exe

MD5
bac2e4856879885af0251cb4cbb3d521

SHA1
a8d3f6492e20e775c84f16a8ca6683a2c1aabc2d

SHA256
18dd7fe65140120d10004e475effb1ce386d8f280094429f4654882120899d73

SHA512
5d550a67764a54145808a12953435a5dd75d1bea8200f2872e288f1eb9f8c0b798db539289950b2c42a0cac4a55689fc65427d1c97afdf83a10881a74d7a1935

Download Submit
C:\Program Files (x86)\HPWombat\HPWombatSrv.exe

MD5
bac2e4856879885af0251cb4cbb3d521

SHA1
a8d3f6492e20e775c84f16a8ca6683a2c1aabc2d

SHA256
18dd7fe65140120d10004e475effb1ce386d8f280094429f4654882120899d73

SHA512
5d550a67764a54145808a12953435a5dd75d1bea8200f2872e288f1eb9f8c0b798db539289950b2c42a0cac4a55689fc65427d1c97afdf83a10881a74d7a1935

Download Submit
C:\Program Files (x86)\HPWombat\WombatStarter.exe

MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
C:\Program Files (x86)\HPWombat\WombatStarter.exe

MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
C:\Program Files (x86)\HPWombat\WombatStarter.exe

MD5
d23253f3a323a0a7c8ecfb08e1e0aa74

SHA1
497bbf7fa1655f7fd921239a00d46c32acebf59d

SHA256
78d7891f42d40171373088aff1bda3fbd5ed4275ac0166a0cfcc7c8001ed4b70

SHA512
cc5072793d2bcefda3d59e145996bbeb47eac8a6887b7472d2ce3d64bcf46a3c9cd97a663920f4510e1ca6626258354dbc4e758a759b089f58d86fa8a4cb7b3d

Download Submit
\Users\Admin\AppData\Local\Temp\nswF2AA.tmp\inetc.dll

MD5
0f70de5c22874df2323f937f7b588bd4

SHA1
ed306624cd687d9e506c7ecd2ac97b7aaf556ff6

SHA256
7f5429361e0195d599ee05643e26985490b2ad85a08943e561898db3b365997b

SHA512
9cc23c1c5fbd07d991adf002fcdfdc3118b5d3648ac2387ef255ddd1377e1f94926f6e466ffe61657858df8e50179f52d647c75637beb2cd833b4ee6e5dc556e

Download Submit
\Users\Admin\AppData\Local\Temp\nswF2AA.tmp\inetc.dll

MD5
0f70de5c22874df2323f937f7b588bd4

SHA1
ed306624cd687d9e506c7ecd2ac97b7aaf556ff6

SHA256
7f5429361e0195d599ee05643e26985490b2ad85a08943e561898db3b365997b

SHA512
9cc23c1c5fbd07d991adf002fcdfdc3118b5d3648ac2387ef255ddd1377e1f94926f6e466ffe61657858df8e50179f52d647c75637beb2cd833b4ee6e5dc556e

Download Submit
\Users\Admin\AppData\Local\Temp\nswF2AA.tmp\nsProcess.dll

MD5
f0438a894f3a7e01a4aae8d1b5dd0289

SHA1
b058e3fcfb7b550041da16bf10d8837024c38bf6

SHA256
30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

SHA512
f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

Download Submit
memory/1804-0-0x0000000000000000-mapping.dmp

Download
memory/3160-6-0x0000000000000000-mapping.dmp

Download