Analysis
-
max time kernel
156s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 08:43
Behavioral task
behavioral1
Sample
8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe
Resource
win10v2004-20220812-en
General
-
Target
8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe
-
Size
3.4MB
-
MD5
e854d8ea7fa2e3609eb837d7be2224b3
-
SHA1
dedcd5578202b9955f3b9f55ffa5652372832b39
-
SHA256
8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99
-
SHA512
487377a3a839c803809e9d6716a42592a9110642a27814fad5b371c84e1ca2a176b96dd6fe056ff981e01a0e7e7532e61a3f7663b53f0a3a236f74655429e520
-
SSDEEP
49152:3fvAp68fIudhTdQR1yocZ4Clrx3PXrtRwW/okzrztg0F8vKD:3qDb3ZDdlP4WQgyQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CompPkgSup.exepid process 3380 CompPkgSup.exe -
Processes:
resource yara_rule behavioral2/memory/984-135-0x00000000002C0000-0x00000000007AA000-memory.dmp vmprotect C:\ProgramData\ComponentUpdater\CompPkgSup.exe vmprotect C:\ProgramData\ComponentUpdater\CompPkgSup.exe vmprotect behavioral2/memory/3380-147-0x00000000005E0000-0x0000000000ACA000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PackagesSupport = "C:\\ProgramData\\ComponentUpdater\\CompPkgSup.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2920 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2920 taskkill.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.execmd.execmd.execmd.execmd.exedescription pid process target process PID 984 wrote to memory of 1572 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 984 wrote to memory of 1572 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 984 wrote to memory of 1572 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 1572 wrote to memory of 2920 1572 cmd.exe taskkill.exe PID 1572 wrote to memory of 2920 1572 cmd.exe taskkill.exe PID 1572 wrote to memory of 2920 1572 cmd.exe taskkill.exe PID 984 wrote to memory of 1476 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 984 wrote to memory of 1476 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 984 wrote to memory of 1476 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 984 wrote to memory of 5076 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 984 wrote to memory of 5076 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 984 wrote to memory of 5076 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 5076 wrote to memory of 4912 5076 cmd.exe attrib.exe PID 5076 wrote to memory of 4912 5076 cmd.exe attrib.exe PID 5076 wrote to memory of 4912 5076 cmd.exe attrib.exe PID 1476 wrote to memory of 4944 1476 cmd.exe attrib.exe PID 1476 wrote to memory of 4944 1476 cmd.exe attrib.exe PID 1476 wrote to memory of 4944 1476 cmd.exe attrib.exe PID 984 wrote to memory of 4784 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe schtasks.exe PID 984 wrote to memory of 4784 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe schtasks.exe PID 984 wrote to memory of 4784 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe schtasks.exe PID 984 wrote to memory of 384 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 984 wrote to memory of 384 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 984 wrote to memory of 384 984 8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe cmd.exe PID 384 wrote to memory of 2036 384 cmd.exe reg.exe PID 384 wrote to memory of 2036 384 cmd.exe reg.exe PID 384 wrote to memory of 2036 384 cmd.exe reg.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4944 attrib.exe 4912 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe"C:\Users\Admin\AppData\Local\Temp\8c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /F /IM CompPkgSup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM CompPkgSup.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ATTRIB +h +s C:\ProgramData\ComponentUpdater2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeATTRIB +h +s C:\ProgramData\ComponentUpdater3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ATTRIB +h +s C:\ProgramData\ComponentUpdater\CompPkgSup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeATTRIB +h +s C:\ProgramData\ComponentUpdater\CompPkgSup.exe3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "PackagesSupport" /tr "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "PackagesSupport" /d "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "PackagesSupport" /d "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeC:\ProgramData\ComponentUpdater\CompPkgSup.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeFilesize
3.4MB
MD5e854d8ea7fa2e3609eb837d7be2224b3
SHA1dedcd5578202b9955f3b9f55ffa5652372832b39
SHA2568c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99
SHA512487377a3a839c803809e9d6716a42592a9110642a27814fad5b371c84e1ca2a176b96dd6fe056ff981e01a0e7e7532e61a3f7663b53f0a3a236f74655429e520
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeFilesize
3.4MB
MD5e854d8ea7fa2e3609eb837d7be2224b3
SHA1dedcd5578202b9955f3b9f55ffa5652372832b39
SHA2568c2dcae5ff5261b3f416d6c80dbcf7e571176310cc2104ac9f486551a2dfac99
SHA512487377a3a839c803809e9d6716a42592a9110642a27814fad5b371c84e1ca2a176b96dd6fe056ff981e01a0e7e7532e61a3f7663b53f0a3a236f74655429e520
-
memory/384-144-0x0000000000000000-mapping.dmp
-
memory/984-135-0x00000000002C0000-0x00000000007AA000-memory.dmpFilesize
4.9MB
-
memory/1476-138-0x0000000000000000-mapping.dmp
-
memory/1572-136-0x0000000000000000-mapping.dmp
-
memory/2036-145-0x0000000000000000-mapping.dmp
-
memory/2920-137-0x0000000000000000-mapping.dmp
-
memory/3380-147-0x00000000005E0000-0x0000000000ACA000-memory.dmpFilesize
4.9MB
-
memory/4784-143-0x0000000000000000-mapping.dmp
-
memory/4912-140-0x0000000000000000-mapping.dmp
-
memory/4944-141-0x0000000000000000-mapping.dmp
-
memory/5076-139-0x0000000000000000-mapping.dmp