Analysis
-
max time kernel
171s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-06-2022 10:14
Static task
static1
Behavioral task
behavioral1
Sample
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe
Resource
win10v2004-20220414-en
General
-
Target
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe
-
Size
152KB
-
MD5
2274dba9c4d0861b407c428a8eb13a07
-
SHA1
c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
-
SHA256
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
-
SHA512
c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Executes dropped EXE 14 IoCs
Processes:
wmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exepid process 3108 wmpntk32.exe 2952 wmpntk32.exe 4416 wmpntk32.exe 2340 wmpntk32.exe 2432 wmpntk32.exe 4000 wmpntk32.exe 3812 wmpntk32.exe 4824 wmpntk32.exe 1244 wmpntk32.exe 2492 wmpntk32.exe 4036 wmpntk32.exe 1384 wmpntk32.exe 3788 wmpntk32.exe 2368 wmpntk32.exe -
Processes:
resource yara_rule behavioral2/memory/2896-132-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2896-135-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2896-136-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2896-137-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2896-138-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2896-143-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2952-149-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2952-150-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2952-151-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2952-154-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2340-163-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2340-166-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4000-175-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4000-179-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4824-188-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/4824-192-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2492-200-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2492-203-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2492-205-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1384-213-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/1384-216-0x0000000000400000-0x0000000000457000-memory.dmp upx behavioral2/memory/2368-225-0x0000000000400000-0x0000000000457000-memory.dmp upx -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exe110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wmpntk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wmpntk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wmpntk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wmpntk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wmpntk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wmpntk32.exe Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe -
Maps connected drives based on registry 3 TTPs 16 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exe110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpntk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpntk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpntk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpntk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpntk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpntk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpntk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpntk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpntk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpntk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpntk32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpntk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpntk32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpntk32.exe -
Drops file in System32 directory 21 IoCs
Processes:
wmpntk32.exewmpntk32.exe110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ wmpntk32.exe File opened for modification C:\Windows\SysWOW64\ wmpntk32.exe File opened for modification C:\Windows\SysWOW64\ 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe File created C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File created C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File created C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File opened for modification C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File opened for modification C:\Windows\SysWOW64\ wmpntk32.exe File created C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File created C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File opened for modification C:\Windows\SysWOW64\wmpntk32.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe File created C:\Windows\SysWOW64\wmpntk32.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe File opened for modification C:\Windows\SysWOW64\ wmpntk32.exe File opened for modification C:\Windows\SysWOW64\ wmpntk32.exe File opened for modification C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File created C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File opened for modification C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File opened for modification C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File opened for modification C:\Windows\SysWOW64\ wmpntk32.exe File opened for modification C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe File opened for modification C:\Windows\SysWOW64\wmpntk32.exe wmpntk32.exe -
Suspicious use of SetThreadContext 8 IoCs
Processes:
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exedescription pid process target process PID 1844 set thread context of 2896 1844 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 3108 set thread context of 2952 3108 wmpntk32.exe wmpntk32.exe PID 4416 set thread context of 2340 4416 wmpntk32.exe wmpntk32.exe PID 2432 set thread context of 4000 2432 wmpntk32.exe wmpntk32.exe PID 3812 set thread context of 4824 3812 wmpntk32.exe wmpntk32.exe PID 1244 set thread context of 2492 1244 wmpntk32.exe wmpntk32.exe PID 4036 set thread context of 1384 4036 wmpntk32.exe wmpntk32.exe PID 3788 set thread context of 2368 3788 wmpntk32.exe wmpntk32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 7 IoCs
Processes:
wmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exe110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpntk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpntk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpntk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpntk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpntk32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ wmpntk32.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exepid process 2896 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 2896 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 2896 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 2896 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 2952 wmpntk32.exe 2952 wmpntk32.exe 2952 wmpntk32.exe 2952 wmpntk32.exe 2340 wmpntk32.exe 2340 wmpntk32.exe 2340 wmpntk32.exe 2340 wmpntk32.exe 4000 wmpntk32.exe 4000 wmpntk32.exe 4000 wmpntk32.exe 4000 wmpntk32.exe 4824 wmpntk32.exe 4824 wmpntk32.exe 4824 wmpntk32.exe 4824 wmpntk32.exe 2492 wmpntk32.exe 2492 wmpntk32.exe 2492 wmpntk32.exe 2492 wmpntk32.exe 1384 wmpntk32.exe 1384 wmpntk32.exe 1384 wmpntk32.exe 1384 wmpntk32.exe 2368 wmpntk32.exe 2368 wmpntk32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exewmpntk32.exedescription pid process target process PID 1844 wrote to memory of 2896 1844 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1844 wrote to memory of 2896 1844 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1844 wrote to memory of 2896 1844 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1844 wrote to memory of 2896 1844 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1844 wrote to memory of 2896 1844 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1844 wrote to memory of 2896 1844 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 1844 wrote to memory of 2896 1844 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe PID 2896 wrote to memory of 3108 2896 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe wmpntk32.exe PID 2896 wrote to memory of 3108 2896 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe wmpntk32.exe PID 2896 wrote to memory of 3108 2896 110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe wmpntk32.exe PID 3108 wrote to memory of 2952 3108 wmpntk32.exe wmpntk32.exe PID 3108 wrote to memory of 2952 3108 wmpntk32.exe wmpntk32.exe PID 3108 wrote to memory of 2952 3108 wmpntk32.exe wmpntk32.exe PID 3108 wrote to memory of 2952 3108 wmpntk32.exe wmpntk32.exe PID 3108 wrote to memory of 2952 3108 wmpntk32.exe wmpntk32.exe PID 3108 wrote to memory of 2952 3108 wmpntk32.exe wmpntk32.exe PID 3108 wrote to memory of 2952 3108 wmpntk32.exe wmpntk32.exe PID 2952 wrote to memory of 4416 2952 wmpntk32.exe wmpntk32.exe PID 2952 wrote to memory of 4416 2952 wmpntk32.exe wmpntk32.exe PID 2952 wrote to memory of 4416 2952 wmpntk32.exe wmpntk32.exe PID 4416 wrote to memory of 2340 4416 wmpntk32.exe wmpntk32.exe PID 4416 wrote to memory of 2340 4416 wmpntk32.exe wmpntk32.exe PID 4416 wrote to memory of 2340 4416 wmpntk32.exe wmpntk32.exe PID 4416 wrote to memory of 2340 4416 wmpntk32.exe wmpntk32.exe PID 4416 wrote to memory of 2340 4416 wmpntk32.exe wmpntk32.exe PID 4416 wrote to memory of 2340 4416 wmpntk32.exe wmpntk32.exe PID 4416 wrote to memory of 2340 4416 wmpntk32.exe wmpntk32.exe PID 2340 wrote to memory of 2432 2340 wmpntk32.exe wmpntk32.exe PID 2340 wrote to memory of 2432 2340 wmpntk32.exe wmpntk32.exe PID 2340 wrote to memory of 2432 2340 wmpntk32.exe wmpntk32.exe PID 2432 wrote to memory of 4000 2432 wmpntk32.exe wmpntk32.exe PID 2432 wrote to memory of 4000 2432 wmpntk32.exe wmpntk32.exe PID 2432 wrote to memory of 4000 2432 wmpntk32.exe wmpntk32.exe PID 2432 wrote to memory of 4000 2432 wmpntk32.exe wmpntk32.exe PID 2432 wrote to memory of 4000 2432 wmpntk32.exe wmpntk32.exe PID 2432 wrote to memory of 4000 2432 wmpntk32.exe wmpntk32.exe PID 2432 wrote to memory of 4000 2432 wmpntk32.exe wmpntk32.exe PID 4000 wrote to memory of 3812 4000 wmpntk32.exe wmpntk32.exe PID 4000 wrote to memory of 3812 4000 wmpntk32.exe wmpntk32.exe PID 4000 wrote to memory of 3812 4000 wmpntk32.exe wmpntk32.exe PID 3812 wrote to memory of 4824 3812 wmpntk32.exe wmpntk32.exe PID 3812 wrote to memory of 4824 3812 wmpntk32.exe wmpntk32.exe PID 3812 wrote to memory of 4824 3812 wmpntk32.exe wmpntk32.exe PID 3812 wrote to memory of 4824 3812 wmpntk32.exe wmpntk32.exe PID 3812 wrote to memory of 4824 3812 wmpntk32.exe wmpntk32.exe PID 3812 wrote to memory of 4824 3812 wmpntk32.exe wmpntk32.exe PID 3812 wrote to memory of 4824 3812 wmpntk32.exe wmpntk32.exe PID 4824 wrote to memory of 1244 4824 wmpntk32.exe wmpntk32.exe PID 4824 wrote to memory of 1244 4824 wmpntk32.exe wmpntk32.exe PID 4824 wrote to memory of 1244 4824 wmpntk32.exe wmpntk32.exe PID 1244 wrote to memory of 2492 1244 wmpntk32.exe wmpntk32.exe PID 1244 wrote to memory of 2492 1244 wmpntk32.exe wmpntk32.exe PID 1244 wrote to memory of 2492 1244 wmpntk32.exe wmpntk32.exe PID 1244 wrote to memory of 2492 1244 wmpntk32.exe wmpntk32.exe PID 1244 wrote to memory of 2492 1244 wmpntk32.exe wmpntk32.exe PID 1244 wrote to memory of 2492 1244 wmpntk32.exe wmpntk32.exe PID 1244 wrote to memory of 2492 1244 wmpntk32.exe wmpntk32.exe PID 2492 wrote to memory of 4036 2492 wmpntk32.exe wmpntk32.exe PID 2492 wrote to memory of 4036 2492 wmpntk32.exe wmpntk32.exe PID 2492 wrote to memory of 4036 2492 wmpntk32.exe wmpntk32.exe PID 4036 wrote to memory of 1384 4036 wmpntk32.exe wmpntk32.exe PID 4036 wrote to memory of 1384 4036 wmpntk32.exe wmpntk32.exe PID 4036 wrote to memory of 1384 4036 wmpntk32.exe wmpntk32.exe PID 4036 wrote to memory of 1384 4036 wmpntk32.exe wmpntk32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe"C:\Users\Admin\AppData\Local\Temp\110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe"C:\Users\Admin\AppData\Local\Temp\110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d.exe"2⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Users\Admin\AppData\Local\Temp\110841~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Users\Admin\AppData\Local\Temp\110841~1.EXE4⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe6⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe8⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe10⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe12⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe14⤵
- Executes dropped EXE
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\wmpntk32.exe"C:\Windows\system32\wmpntk32.exe" C:\Windows\SysWOW64\wmpntk32.exe16⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
C:\Windows\SysWOW64\wmpntk32.exeFilesize
152KB
MD52274dba9c4d0861b407c428a8eb13a07
SHA1c49a8c69b8e17ddbe3f13f570e43b5887d7e35f7
SHA256110841b6d0517e77741d0c254f71bd8a3d39d405d5742ee2e2d8ce1536d9103d
SHA512c6605052245c95ef8fcd5468d4621f050c6dc835765b021ab5b4377278de22bd8149281dd0d9781e9a2a79d779204ed4736d4a146ebe2b740d20afb00a840d9c
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1244-191-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1244-189-0x0000000000000000-mapping.dmp
-
memory/1244-196-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1384-206-0x0000000000000000-mapping.dmp
-
memory/1384-213-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1384-216-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1844-130-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1844-134-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2340-166-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2340-156-0x0000000000000000-mapping.dmp
-
memory/2340-163-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2368-218-0x0000000000000000-mapping.dmp
-
memory/2368-225-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2432-164-0x0000000000000000-mapping.dmp
-
memory/2432-167-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2432-171-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/2492-200-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2492-193-0x0000000000000000-mapping.dmp
-
memory/2492-205-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2492-203-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2896-131-0x0000000000000000-mapping.dmp
-
memory/2896-132-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2896-135-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2896-136-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2896-137-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2896-138-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2896-143-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2952-154-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2952-144-0x0000000000000000-mapping.dmp
-
memory/2952-151-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2952-150-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/2952-149-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/3108-142-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3108-139-0x0000000000000000-mapping.dmp
-
memory/3108-147-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3788-221-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3788-214-0x0000000000000000-mapping.dmp
-
memory/3788-217-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3812-177-0x0000000000000000-mapping.dmp
-
memory/3812-184-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3812-180-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4000-179-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/4000-168-0x0000000000000000-mapping.dmp
-
memory/4000-175-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/4036-209-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4036-204-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4036-201-0x0000000000000000-mapping.dmp
-
memory/4416-152-0x0000000000000000-mapping.dmp
-
memory/4416-155-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4416-159-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/4824-181-0x0000000000000000-mapping.dmp
-
memory/4824-188-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/4824-192-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB