Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
25-07-2022 02:01
Behavioral task
behavioral1
Sample
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe
Resource
win10v2004-20220721-en
General
-
Target
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe
-
Size
135KB
-
MD5
56aeb673dbe8e0bd5581765ce65d0329
-
SHA1
11639dc9624dc74de9c554823632fd6d524b9989
-
SHA256
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7
-
SHA512
08b3ee074f7b351ede370537dde110e6f7dfc5202ac67ba05cc5998d293a0b2aaac96f9aa064cf5ecd2450c55b3ee3a96c414977a238a9cf420128b1a44a20e6
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
suricata: ET MALWARE IRC Nick change on non-standard port
suricata: ET MALWARE IRC Nick change on non-standard port
-
suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)
suricata: ET MALWARE Likely Bot Nick in IRC (USA +..)
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\wmisrv.exe" 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe -
Executes dropped EXE 2 IoCs
Processes:
wmisrv.exewmisrv.exepid process 2792 wmisrv.exe 460 wmisrv.exe -
Processes:
resource yara_rule behavioral2/memory/4724-130-0x0000000000400000-0x0000000000454000-memory.dmp upx behavioral2/memory/4724-137-0x0000000000400000-0x0000000000454000-memory.dmp upx C:\Windows\SysWOW64\wmisrv.exe upx C:\Windows\SysWOW64\wmisrv.exe upx behavioral2/memory/2792-145-0x0000000000400000-0x0000000000454000-memory.dmp upx C:\Windows\SysWOW64\wmisrv.exe upx behavioral2/memory/2792-151-0x0000000000400000-0x0000000000454000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup = "C:\\Windows\\system32\\wmisrv.exe" 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe -
Drops file in System32 directory 4 IoCs
Processes:
wmisrv.exe88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exedescription ioc process File created C:\Windows\SysWOW64\wmisrv.exe wmisrv.exe File created C:\Windows\SysWOW64\wmisrv.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe File opened for modification C:\Windows\SysWOW64\wmisrv.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe File opened for modification C:\Windows\SysWOW64\wmisrv.exe wmisrv.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exewmisrv.exedescription pid process target process PID 4724 set thread context of 4816 4724 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe PID 2792 set thread context of 460 2792 wmisrv.exe wmisrv.exe -
Drops file in Windows directory 1 IoCs
Processes:
wmisrv.exedescription ioc process File created C:\Windows\logfile32.txt wmisrv.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exewmisrv.exepid process 4816 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 4816 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 4816 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 4816 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 4816 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 4816 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 460 wmisrv.exe 460 wmisrv.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exewmisrv.exedescription pid process Token: SeDebugPrivilege 4816 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe Token: SeDebugPrivilege 460 wmisrv.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exewmisrv.exepid process 4724 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 2792 wmisrv.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exewmisrv.exedescription pid process target process PID 4724 wrote to memory of 4816 4724 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe PID 4724 wrote to memory of 4816 4724 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe PID 4724 wrote to memory of 4816 4724 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe PID 4724 wrote to memory of 4816 4724 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe PID 4724 wrote to memory of 4816 4724 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe PID 4724 wrote to memory of 4816 4724 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe PID 4724 wrote to memory of 4816 4724 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe PID 4724 wrote to memory of 4816 4724 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe PID 4816 wrote to memory of 2792 4816 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe wmisrv.exe PID 4816 wrote to memory of 2792 4816 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe wmisrv.exe PID 4816 wrote to memory of 2792 4816 88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe wmisrv.exe PID 2792 wrote to memory of 460 2792 wmisrv.exe wmisrv.exe PID 2792 wrote to memory of 460 2792 wmisrv.exe wmisrv.exe PID 2792 wrote to memory of 460 2792 wmisrv.exe wmisrv.exe PID 2792 wrote to memory of 460 2792 wmisrv.exe wmisrv.exe PID 2792 wrote to memory of 460 2792 wmisrv.exe wmisrv.exe PID 2792 wrote to memory of 460 2792 wmisrv.exe wmisrv.exe PID 2792 wrote to memory of 460 2792 wmisrv.exe wmisrv.exe PID 2792 wrote to memory of 460 2792 wmisrv.exe wmisrv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe"C:\Users\Admin\AppData\Local\Temp\88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe"C:\Users\Admin\AppData\Local\Temp\88a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\wmisrv.exe"C:\Windows\system32\wmisrv.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\wmisrv.exe"C:\Windows\SysWOW64\wmisrv.exe"4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmisrv.exeFilesize
135KB
MD556aeb673dbe8e0bd5581765ce65d0329
SHA111639dc9624dc74de9c554823632fd6d524b9989
SHA25688a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7
SHA51208b3ee074f7b351ede370537dde110e6f7dfc5202ac67ba05cc5998d293a0b2aaac96f9aa064cf5ecd2450c55b3ee3a96c414977a238a9cf420128b1a44a20e6
-
C:\Windows\SysWOW64\wmisrv.exeFilesize
135KB
MD556aeb673dbe8e0bd5581765ce65d0329
SHA111639dc9624dc74de9c554823632fd6d524b9989
SHA25688a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7
SHA51208b3ee074f7b351ede370537dde110e6f7dfc5202ac67ba05cc5998d293a0b2aaac96f9aa064cf5ecd2450c55b3ee3a96c414977a238a9cf420128b1a44a20e6
-
C:\Windows\SysWOW64\wmisrv.exeFilesize
135KB
MD556aeb673dbe8e0bd5581765ce65d0329
SHA111639dc9624dc74de9c554823632fd6d524b9989
SHA25688a5517763da63d9fc6b3499ca7a6243474ace019cf5a7f295110d272f6e28c7
SHA51208b3ee074f7b351ede370537dde110e6f7dfc5202ac67ba05cc5998d293a0b2aaac96f9aa064cf5ecd2450c55b3ee3a96c414977a238a9cf420128b1a44a20e6
-
memory/460-152-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/460-146-0x0000000000000000-mapping.dmp
-
memory/2792-151-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/2792-145-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/2792-139-0x0000000000000000-mapping.dmp
-
memory/4724-137-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/4724-130-0x0000000000400000-0x0000000000454000-memory.dmpFilesize
336KB
-
memory/4816-144-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4816-138-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4816-136-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4816-134-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/4816-133-0x0000000000000000-mapping.dmp