Analysis
-
max time kernel
87s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-09-2022 03:06
Static task
static1
Behavioral task
behavioral1
Sample
d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe
Resource
win10v2004-20220901-en
General
-
Target
d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe
-
Size
133KB
-
MD5
0c615d689ff9c3073a3dc6e5f2255cea
-
SHA1
232ca5b45717fffd53085b45ef5a139167875631
-
SHA256
d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074
-
SHA512
847cf78dc2a8f8c6b204b58a1942e30193b317edd2ebdf7862b0dd7e7b69a39b9145b313a9ed7fbb47c7df66c423fb5aee51dfad4a94852462abf418d028a7f1
-
SSDEEP
3072:ZHpylbWMebpJaVpG74ZjV6x1YpuieRYY64l:ZieDa3G+iYwieOY6o
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
wmpkd32.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpkd32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpkd32.exe = "C:\\Windows\\SysWOW64\\wmpkd32.exe:*:Enabled:WinMedia Server" wmpkd32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpkd32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpkd32.exe = "C:\\Windows\\SysWOW64\\wmpkd32.exe:*:Enabled:WinMedia Server" wmpkd32.exe -
Executes dropped EXE 2 IoCs
Processes:
wmpkd32.exewmpkd32.exepid process 1516 wmpkd32.exe 1620 wmpkd32.exe -
Processes:
resource yara_rule behavioral1/memory/832-55-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/832-57-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/832-58-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/832-62-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/832-63-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/832-64-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/832-65-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/832-82-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1620-83-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral1/memory/1620-84-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
wmpkd32.exepid process 1620 wmpkd32.exe -
Loads dropped DLL 2 IoCs
Processes:
d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exepid process 832 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe 832 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wmpkd32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wmpkd32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WinMedia Server = "C:\\Windows\\SysWOW64\\wmpkd32.exe" wmpkd32.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wmpkd32.exed97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpkd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpkd32.exe -
Drops file in System32 directory 4 IoCs
Processes:
d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exewmpkd32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe File opened for modification C:\Windows\SysWOW64\wmpkd32.exe d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe File created C:\Windows\SysWOW64\wmpkd32.exe d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe File opened for modification C:\Windows\SysWOW64\ wmpkd32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exewmpkd32.exedescription pid process target process PID 576 set thread context of 832 576 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe PID 1516 set thread context of 1620 1516 wmpkd32.exe wmpkd32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exewmpkd32.exepid process 832 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe 832 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe 1620 wmpkd32.exe 1620 wmpkd32.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exed97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exewmpkd32.exewmpkd32.exedescription pid process target process PID 576 wrote to memory of 832 576 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe PID 576 wrote to memory of 832 576 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe PID 576 wrote to memory of 832 576 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe PID 576 wrote to memory of 832 576 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe PID 576 wrote to memory of 832 576 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe PID 576 wrote to memory of 832 576 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe PID 576 wrote to memory of 832 576 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe PID 832 wrote to memory of 1516 832 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe wmpkd32.exe PID 832 wrote to memory of 1516 832 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe wmpkd32.exe PID 832 wrote to memory of 1516 832 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe wmpkd32.exe PID 832 wrote to memory of 1516 832 d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe wmpkd32.exe PID 1516 wrote to memory of 1620 1516 wmpkd32.exe wmpkd32.exe PID 1516 wrote to memory of 1620 1516 wmpkd32.exe wmpkd32.exe PID 1516 wrote to memory of 1620 1516 wmpkd32.exe wmpkd32.exe PID 1516 wrote to memory of 1620 1516 wmpkd32.exe wmpkd32.exe PID 1516 wrote to memory of 1620 1516 wmpkd32.exe wmpkd32.exe PID 1516 wrote to memory of 1620 1516 wmpkd32.exe wmpkd32.exe PID 1516 wrote to memory of 1620 1516 wmpkd32.exe wmpkd32.exe PID 1620 wrote to memory of 1384 1620 wmpkd32.exe Explorer.EXE PID 1620 wrote to memory of 1384 1620 wmpkd32.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe"C:\Users\Admin\AppData\Local\Temp\d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe"C:\Users\Admin\AppData\Local\Temp\d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074.exe"3⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\wmpkd32.exe"C:\Windows\SysWOW64\wmpkd32.exe" C:\Users\Admin\AppData\Local\Temp\D97AA6~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\wmpkd32.exe"C:\Windows\SysWOW64\wmpkd32.exe" C:\Users\Admin\AppData\Local\Temp\D97AA6~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD50c615d689ff9c3073a3dc6e5f2255cea
SHA1232ca5b45717fffd53085b45ef5a139167875631
SHA256d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074
SHA512847cf78dc2a8f8c6b204b58a1942e30193b317edd2ebdf7862b0dd7e7b69a39b9145b313a9ed7fbb47c7df66c423fb5aee51dfad4a94852462abf418d028a7f1
-
Filesize
133KB
MD50c615d689ff9c3073a3dc6e5f2255cea
SHA1232ca5b45717fffd53085b45ef5a139167875631
SHA256d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074
SHA512847cf78dc2a8f8c6b204b58a1942e30193b317edd2ebdf7862b0dd7e7b69a39b9145b313a9ed7fbb47c7df66c423fb5aee51dfad4a94852462abf418d028a7f1
-
Filesize
133KB
MD50c615d689ff9c3073a3dc6e5f2255cea
SHA1232ca5b45717fffd53085b45ef5a139167875631
SHA256d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074
SHA512847cf78dc2a8f8c6b204b58a1942e30193b317edd2ebdf7862b0dd7e7b69a39b9145b313a9ed7fbb47c7df66c423fb5aee51dfad4a94852462abf418d028a7f1
-
Filesize
133KB
MD50c615d689ff9c3073a3dc6e5f2255cea
SHA1232ca5b45717fffd53085b45ef5a139167875631
SHA256d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074
SHA512847cf78dc2a8f8c6b204b58a1942e30193b317edd2ebdf7862b0dd7e7b69a39b9145b313a9ed7fbb47c7df66c423fb5aee51dfad4a94852462abf418d028a7f1
-
Filesize
133KB
MD50c615d689ff9c3073a3dc6e5f2255cea
SHA1232ca5b45717fffd53085b45ef5a139167875631
SHA256d97aa681a9f6f0978b56882998dad0a2c347b121ff094f13a200a61daa769074
SHA512847cf78dc2a8f8c6b204b58a1942e30193b317edd2ebdf7862b0dd7e7b69a39b9145b313a9ed7fbb47c7df66c423fb5aee51dfad4a94852462abf418d028a7f1