Analysis
-
max time kernel
99s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2022 00:58
Static task
static1
Behavioral task
behavioral1
Sample
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe
Resource
win10v2004-20220812-en
General
-
Target
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe
-
Size
158KB
-
MD5
438da4197174e0670d0f61df97b96f42
-
SHA1
34c1d26f80ea215b7cfe8afe9061702a60bffd94
-
SHA256
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907
-
SHA512
e208d183a44cb0dbaa3087c23fa50d659c77d43c55a1ab08a70b289c1d3442a1dca41b40781ecabb74630fe5a2aeb31f780281f3e106a8bf2f2ef3e13db85ff9
-
SSDEEP
3072:i/xCY0LHTUY6P5BuvTGzUxQ2DfmUgGnroFHV8wlf9i75Lu:kxCYAuub2Uu23kVx0Zu
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
wmpnp32.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile wmpnp32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications wmpnp32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpnp32.exe = "C:\\Windows\\SysWOW64\\wmpnp32.exe:*:Enabled:Windows Network Core" wmpnp32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpnp32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile wmpnp32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications wmpnp32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpnp32.exe = "C:\\Windows\\SysWOW64\\wmpnp32.exe:*:Enabled:Windows Network Core" wmpnp32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpnp32.exe -
Executes dropped EXE 2 IoCs
Processes:
wmpnp32.exewmpnp32.exepid process 408 wmpnp32.exe 2508 wmpnp32.exe -
Processes:
resource yara_rule behavioral2/memory/2180-133-0x0000000000400000-0x000000000044C000-memory.dmp upx behavioral2/memory/2180-135-0x0000000000400000-0x000000000044C000-memory.dmp upx behavioral2/memory/2180-136-0x0000000000400000-0x000000000044C000-memory.dmp upx behavioral2/memory/2180-137-0x0000000000400000-0x000000000042F000-memory.dmp upx behavioral2/memory/2508-147-0x0000000000400000-0x000000000044C000-memory.dmp upx behavioral2/memory/2508-148-0x0000000000400000-0x000000000044C000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wmpnp32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wmpnp32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Network Core = "C:\\Windows\\SysWOW64\\wmpnp32.exe" wmpnp32.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exewmpnp32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpnp32.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpnp32.exe -
Drops file in System32 directory 4 IoCs
Processes:
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exewmpnp32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe File opened for modification C:\Windows\SysWOW64\wmpnp32.exe 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe File created C:\Windows\SysWOW64\wmpnp32.exe 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe File opened for modification C:\Windows\SysWOW64\ wmpnp32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exewmpnp32.exedescription pid process target process PID 1104 set thread context of 2180 1104 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe PID 408 set thread context of 2508 408 wmpnp32.exe wmpnp32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exewmpnp32.exepid process 2180 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 2180 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 2180 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 2180 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 2508 wmpnp32.exe 2508 wmpnp32.exe 2508 wmpnp32.exe 2508 wmpnp32.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exepid process 1104 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exewmpnp32.exewmpnp32.exedescription pid process target process PID 1104 wrote to memory of 2180 1104 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe PID 1104 wrote to memory of 2180 1104 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe PID 1104 wrote to memory of 2180 1104 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe PID 1104 wrote to memory of 2180 1104 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe PID 1104 wrote to memory of 2180 1104 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe PID 1104 wrote to memory of 2180 1104 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe PID 1104 wrote to memory of 2180 1104 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe PID 2180 wrote to memory of 408 2180 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe wmpnp32.exe PID 2180 wrote to memory of 408 2180 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe wmpnp32.exe PID 2180 wrote to memory of 408 2180 6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe wmpnp32.exe PID 408 wrote to memory of 2508 408 wmpnp32.exe wmpnp32.exe PID 408 wrote to memory of 2508 408 wmpnp32.exe wmpnp32.exe PID 408 wrote to memory of 2508 408 wmpnp32.exe wmpnp32.exe PID 408 wrote to memory of 2508 408 wmpnp32.exe wmpnp32.exe PID 408 wrote to memory of 2508 408 wmpnp32.exe wmpnp32.exe PID 408 wrote to memory of 2508 408 wmpnp32.exe wmpnp32.exe PID 408 wrote to memory of 2508 408 wmpnp32.exe wmpnp32.exe PID 2508 wrote to memory of 600 2508 wmpnp32.exe Explorer.EXE PID 2508 wrote to memory of 600 2508 wmpnp32.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe"C:\Users\Admin\AppData\Local\Temp\6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe"C:\Users\Admin\AppData\Local\Temp\6be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpnp32.exe"C:\Windows\SysWOW64\wmpnp32.exe" C:\Users\Admin\AppData\Local\Temp\6BE005~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpnp32.exe"C:\Windows\SysWOW64\wmpnp32.exe" C:\Users\Admin\AppData\Local\Temp\6BE005~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmpnp32.exeFilesize
158KB
MD5438da4197174e0670d0f61df97b96f42
SHA134c1d26f80ea215b7cfe8afe9061702a60bffd94
SHA2566be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907
SHA512e208d183a44cb0dbaa3087c23fa50d659c77d43c55a1ab08a70b289c1d3442a1dca41b40781ecabb74630fe5a2aeb31f780281f3e106a8bf2f2ef3e13db85ff9
-
C:\Windows\SysWOW64\wmpnp32.exeFilesize
158KB
MD5438da4197174e0670d0f61df97b96f42
SHA134c1d26f80ea215b7cfe8afe9061702a60bffd94
SHA2566be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907
SHA512e208d183a44cb0dbaa3087c23fa50d659c77d43c55a1ab08a70b289c1d3442a1dca41b40781ecabb74630fe5a2aeb31f780281f3e106a8bf2f2ef3e13db85ff9
-
C:\Windows\SysWOW64\wmpnp32.exeFilesize
158KB
MD5438da4197174e0670d0f61df97b96f42
SHA134c1d26f80ea215b7cfe8afe9061702a60bffd94
SHA2566be005d1491e166d2ef511080bc164e2a951acfebbd2c33d2d0f7c8f5c841907
SHA512e208d183a44cb0dbaa3087c23fa50d659c77d43c55a1ab08a70b289c1d3442a1dca41b40781ecabb74630fe5a2aeb31f780281f3e106a8bf2f2ef3e13db85ff9
-
memory/408-138-0x0000000000000000-mapping.dmp
-
memory/2180-132-0x0000000000000000-mapping.dmp
-
memory/2180-133-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2180-135-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2180-136-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2180-137-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/2508-141-0x0000000000000000-mapping.dmp
-
memory/2508-147-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/2508-148-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB