Analysis
-
max time kernel
93s -
max time network
102s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe
Resource
win10v2004-20220414-en
General
-
Target
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe
-
Size
196KB
-
MD5
3c181cfcea54d961d19e27963695dae8
-
SHA1
ee855b053ded0503b2521fe03b5cbf66e2dce67a
-
SHA256
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981
-
SHA512
54ce8d26b7b5b3e2054a4d9851478e8c655bb135d5d0ff144502b0d021e5fdcb38aacfe81cb1d5af6ab65a8dec4b467551f91a65311c59014ae86980cd23632d
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
wmphb32.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmphb32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmphb32.exe = "C:\\Windows\\SysWOW64\\wmphb32.exe:*:Enabled:Windows Host Network" wmphb32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmphb32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmphb32.exe = "C:\\Windows\\SysWOW64\\wmphb32.exe:*:Enabled:Windows Host Network" wmphb32.exe -
Executes dropped EXE 2 IoCs
Processes:
wmphb32.exewmphb32.exepid process 1464 wmphb32.exe 1736 wmphb32.exe -
Processes:
resource yara_rule behavioral1/memory/308-55-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/308-57-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/308-58-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/308-63-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/308-64-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/308-65-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/308-66-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/308-81-0x0000000002D80000-0x0000000002DCD000-memory.dmp upx behavioral1/memory/308-86-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1736-84-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1736-88-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1736-89-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
wmphb32.exepid process 1736 wmphb32.exe -
Loads dropped DLL 2 IoCs
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exepid process 308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wmphb32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wmphb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Host Network = "C:\\Windows\\SysWOW64\\wmphb32.exe" wmphb32.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wmphb32.exe8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmphb32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmphb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe -
Drops file in System32 directory 4 IoCs
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exewmphb32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe File opened for modification C:\Windows\SysWOW64\wmphb32.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe File created C:\Windows\SysWOW64\wmphb32.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe File opened for modification C:\Windows\SysWOW64\ wmphb32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exewmphb32.exedescription pid process target process PID 1308 set thread context of 308 1308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 1464 set thread context of 1736 1464 wmphb32.exe wmphb32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exewmphb32.exepid process 308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 1736 wmphb32.exe 1736 wmphb32.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exewmphb32.exewmphb32.exedescription pid process target process PID 1308 wrote to memory of 308 1308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 1308 wrote to memory of 308 1308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 1308 wrote to memory of 308 1308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 1308 wrote to memory of 308 1308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 1308 wrote to memory of 308 1308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 1308 wrote to memory of 308 1308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 1308 wrote to memory of 308 1308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 308 wrote to memory of 1464 308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe wmphb32.exe PID 308 wrote to memory of 1464 308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe wmphb32.exe PID 308 wrote to memory of 1464 308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe wmphb32.exe PID 308 wrote to memory of 1464 308 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe wmphb32.exe PID 1464 wrote to memory of 1736 1464 wmphb32.exe wmphb32.exe PID 1464 wrote to memory of 1736 1464 wmphb32.exe wmphb32.exe PID 1464 wrote to memory of 1736 1464 wmphb32.exe wmphb32.exe PID 1464 wrote to memory of 1736 1464 wmphb32.exe wmphb32.exe PID 1464 wrote to memory of 1736 1464 wmphb32.exe wmphb32.exe PID 1464 wrote to memory of 1736 1464 wmphb32.exe wmphb32.exe PID 1464 wrote to memory of 1736 1464 wmphb32.exe wmphb32.exe PID 1736 wrote to memory of 1396 1736 wmphb32.exe Explorer.EXE PID 1736 wrote to memory of 1396 1736 wmphb32.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe"C:\Users\Admin\AppData\Local\Temp\8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe"C:\Users\Admin\AppData\Local\Temp\8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe"3⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmphb32.exe"C:\Windows\SysWOW64\wmphb32.exe" C:\Users\Admin\AppData\Local\Temp\8241C0~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmphb32.exe"C:\Windows\SysWOW64\wmphb32.exe" C:\Users\Admin\AppData\Local\Temp\8241C0~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmphb32.exeFilesize
196KB
MD53c181cfcea54d961d19e27963695dae8
SHA1ee855b053ded0503b2521fe03b5cbf66e2dce67a
SHA2568241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981
SHA51254ce8d26b7b5b3e2054a4d9851478e8c655bb135d5d0ff144502b0d021e5fdcb38aacfe81cb1d5af6ab65a8dec4b467551f91a65311c59014ae86980cd23632d
-
C:\Windows\SysWOW64\wmphb32.exeFilesize
196KB
MD53c181cfcea54d961d19e27963695dae8
SHA1ee855b053ded0503b2521fe03b5cbf66e2dce67a
SHA2568241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981
SHA51254ce8d26b7b5b3e2054a4d9851478e8c655bb135d5d0ff144502b0d021e5fdcb38aacfe81cb1d5af6ab65a8dec4b467551f91a65311c59014ae86980cd23632d
-
C:\Windows\SysWOW64\wmphb32.exeFilesize
196KB
MD53c181cfcea54d961d19e27963695dae8
SHA1ee855b053ded0503b2521fe03b5cbf66e2dce67a
SHA2568241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981
SHA51254ce8d26b7b5b3e2054a4d9851478e8c655bb135d5d0ff144502b0d021e5fdcb38aacfe81cb1d5af6ab65a8dec4b467551f91a65311c59014ae86980cd23632d
-
\Windows\SysWOW64\wmphb32.exeFilesize
196KB
MD53c181cfcea54d961d19e27963695dae8
SHA1ee855b053ded0503b2521fe03b5cbf66e2dce67a
SHA2568241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981
SHA51254ce8d26b7b5b3e2054a4d9851478e8c655bb135d5d0ff144502b0d021e5fdcb38aacfe81cb1d5af6ab65a8dec4b467551f91a65311c59014ae86980cd23632d
-
\Windows\SysWOW64\wmphb32.exeFilesize
196KB
MD53c181cfcea54d961d19e27963695dae8
SHA1ee855b053ded0503b2521fe03b5cbf66e2dce67a
SHA2568241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981
SHA51254ce8d26b7b5b3e2054a4d9851478e8c655bb135d5d0ff144502b0d021e5fdcb38aacfe81cb1d5af6ab65a8dec4b467551f91a65311c59014ae86980cd23632d
-
memory/308-62-0x0000000075261000-0x0000000075263000-memory.dmpFilesize
8KB
-
memory/308-57-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/308-63-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/308-64-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/308-65-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/308-66-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/308-82-0x0000000002D80000-0x0000000002DCD000-memory.dmpFilesize
308KB
-
memory/308-81-0x0000000002D80000-0x0000000002DCD000-memory.dmpFilesize
308KB
-
memory/308-58-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/308-59-0x000000000044EAB0-mapping.dmp
-
memory/308-86-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/308-54-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/308-55-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1308-61-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/1396-90-0x0000000002200000-0x000000000221E000-memory.dmpFilesize
120KB
-
memory/1464-80-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/1464-69-0x0000000000000000-mapping.dmp
-
memory/1736-84-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1736-77-0x000000000044EAB0-mapping.dmp
-
memory/1736-88-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1736-89-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB