Analysis
-
max time kernel
99s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe
Resource
win10v2004-20220414-en
General
-
Target
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe
-
Size
196KB
-
MD5
3c181cfcea54d961d19e27963695dae8
-
SHA1
ee855b053ded0503b2521fe03b5cbf66e2dce67a
-
SHA256
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981
-
SHA512
54ce8d26b7b5b3e2054a4d9851478e8c655bb135d5d0ff144502b0d021e5fdcb38aacfe81cb1d5af6ab65a8dec4b467551f91a65311c59014ae86980cd23632d
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
wmphb32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmphb32.exe = "C:\\Windows\\SysWOW64\\wmphb32.exe:*:Enabled:Windows Host Network" wmphb32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmphb32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile wmphb32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications wmphb32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmphb32.exe = "C:\\Windows\\SysWOW64\\wmphb32.exe:*:Enabled:Windows Host Network" wmphb32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmphb32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile wmphb32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications wmphb32.exe -
Executes dropped EXE 2 IoCs
Processes:
wmphb32.exewmphb32.exepid process 4672 wmphb32.exe 4680 wmphb32.exe -
Processes:
resource yara_rule behavioral2/memory/1048-132-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1048-136-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1048-137-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1048-138-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1048-139-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/1048-143-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4680-149-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4680-150-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4680-151-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4680-152-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4680-153-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wmphb32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wmphb32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Host Network = "C:\\Windows\\SysWOW64\\wmphb32.exe" wmphb32.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wmphb32.exe8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmphb32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmphb32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe -
Drops file in System32 directory 4 IoCs
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exewmphb32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe File opened for modification C:\Windows\SysWOW64\wmphb32.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe File created C:\Windows\SysWOW64\wmphb32.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe File opened for modification C:\Windows\SysWOW64\ wmphb32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exewmphb32.exedescription pid process target process PID 2848 set thread context of 1048 2848 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 4672 set thread context of 4680 4672 wmphb32.exe wmphb32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exewmphb32.exepid process 1048 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 1048 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 1048 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 1048 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 4680 wmphb32.exe 4680 wmphb32.exe 4680 wmphb32.exe 4680 wmphb32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exewmphb32.exewmphb32.exedescription pid process target process PID 2848 wrote to memory of 1048 2848 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 2848 wrote to memory of 1048 2848 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 2848 wrote to memory of 1048 2848 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 2848 wrote to memory of 1048 2848 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 2848 wrote to memory of 1048 2848 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 2848 wrote to memory of 1048 2848 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 2848 wrote to memory of 1048 2848 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe PID 1048 wrote to memory of 4672 1048 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe wmphb32.exe PID 1048 wrote to memory of 4672 1048 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe wmphb32.exe PID 1048 wrote to memory of 4672 1048 8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe wmphb32.exe PID 4672 wrote to memory of 4680 4672 wmphb32.exe wmphb32.exe PID 4672 wrote to memory of 4680 4672 wmphb32.exe wmphb32.exe PID 4672 wrote to memory of 4680 4672 wmphb32.exe wmphb32.exe PID 4672 wrote to memory of 4680 4672 wmphb32.exe wmphb32.exe PID 4672 wrote to memory of 4680 4672 wmphb32.exe wmphb32.exe PID 4672 wrote to memory of 4680 4672 wmphb32.exe wmphb32.exe PID 4672 wrote to memory of 4680 4672 wmphb32.exe wmphb32.exe PID 4680 wrote to memory of 676 4680 wmphb32.exe Explorer.EXE PID 4680 wrote to memory of 676 4680 wmphb32.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe"C:\Users\Admin\AppData\Local\Temp\8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe"C:\Users\Admin\AppData\Local\Temp\8241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmphb32.exe"C:\Windows\SysWOW64\wmphb32.exe" C:\Users\Admin\AppData\Local\Temp\8241C0~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmphb32.exe"C:\Windows\SysWOW64\wmphb32.exe" C:\Users\Admin\AppData\Local\Temp\8241C0~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmphb32.exeFilesize
196KB
MD53c181cfcea54d961d19e27963695dae8
SHA1ee855b053ded0503b2521fe03b5cbf66e2dce67a
SHA2568241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981
SHA51254ce8d26b7b5b3e2054a4d9851478e8c655bb135d5d0ff144502b0d021e5fdcb38aacfe81cb1d5af6ab65a8dec4b467551f91a65311c59014ae86980cd23632d
-
C:\Windows\SysWOW64\wmphb32.exeFilesize
196KB
MD53c181cfcea54d961d19e27963695dae8
SHA1ee855b053ded0503b2521fe03b5cbf66e2dce67a
SHA2568241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981
SHA51254ce8d26b7b5b3e2054a4d9851478e8c655bb135d5d0ff144502b0d021e5fdcb38aacfe81cb1d5af6ab65a8dec4b467551f91a65311c59014ae86980cd23632d
-
C:\Windows\SysWOW64\wmphb32.exeFilesize
196KB
MD53c181cfcea54d961d19e27963695dae8
SHA1ee855b053ded0503b2521fe03b5cbf66e2dce67a
SHA2568241c034f317bfc1fb229bec9e78a8877e6b06bac3754377a161df3031cc8981
SHA51254ce8d26b7b5b3e2054a4d9851478e8c655bb135d5d0ff144502b0d021e5fdcb38aacfe81cb1d5af6ab65a8dec4b467551f91a65311c59014ae86980cd23632d
-
memory/1048-137-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1048-138-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1048-139-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1048-132-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1048-143-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1048-136-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/1048-131-0x0000000000000000-mapping.dmp
-
memory/2848-130-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/2848-134-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/4672-148-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/4672-140-0x0000000000000000-mapping.dmp
-
memory/4680-144-0x0000000000000000-mapping.dmp
-
memory/4680-149-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4680-150-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4680-151-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4680-152-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4680-153-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB