Analysis
-
max time kernel
239s -
max time network
335s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 10:02
Behavioral task
behavioral1
Sample
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe
Resource
win10v2004-20220812-en
General
-
Target
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe
-
Size
3.4MB
-
MD5
b4fe4d2ea25842e9e9bb863d330f49ab
-
SHA1
32f87e90e1ed0362bd2b8bf2d852c53005adc664
-
SHA256
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7
-
SHA512
430cd1cdce7bc8f44094f1c642f16c5578c1d16dcbcb3feed24bc34cc469a9a63bb6c6ed71e4f9ebaf339b8a67c0f52b9fde74e35415d4ae86313b2e5f2c8952
-
SSDEEP
49152:nj3vbky6xLIy2volN4mVppF4DhbTghyZGEy7rCX26Th1JO0DYpHRKMJnoYEAp7m5:jfbWRdzONbTghIGLfCmY80E5noYE7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CompPkgSup.exepid process 1624 CompPkgSup.exe -
Processes:
resource yara_rule behavioral1/memory/652-55-0x00000000012D0000-0x00000000017D8000-memory.dmp vmprotect C:\ProgramData\ComponentUpdater\CompPkgSup.exe vmprotect C:\ProgramData\ComponentUpdater\CompPkgSup.exe vmprotect behavioral1/memory/1624-71-0x0000000000AB0000-0x0000000000FB8000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\PackagesSupport = "C:\\ProgramData\\ComponentUpdater\\CompPkgSup.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1548 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1548 taskkill.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.execmd.execmd.execmd.execmd.exetaskeng.exedescription pid process target process PID 652 wrote to memory of 560 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 560 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 560 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 560 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 560 wrote to memory of 1548 560 cmd.exe taskkill.exe PID 560 wrote to memory of 1548 560 cmd.exe taskkill.exe PID 560 wrote to memory of 1548 560 cmd.exe taskkill.exe PID 560 wrote to memory of 1548 560 cmd.exe taskkill.exe PID 652 wrote to memory of 1536 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1536 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1536 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1536 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1132 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1132 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1132 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1132 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1560 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe schtasks.exe PID 652 wrote to memory of 1560 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe schtasks.exe PID 652 wrote to memory of 1560 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe schtasks.exe PID 652 wrote to memory of 1560 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe schtasks.exe PID 652 wrote to memory of 1840 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1840 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1840 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 652 wrote to memory of 1840 652 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 1536 wrote to memory of 1672 1536 cmd.exe attrib.exe PID 1536 wrote to memory of 1672 1536 cmd.exe attrib.exe PID 1536 wrote to memory of 1672 1536 cmd.exe attrib.exe PID 1536 wrote to memory of 1672 1536 cmd.exe attrib.exe PID 1132 wrote to memory of 1240 1132 cmd.exe attrib.exe PID 1132 wrote to memory of 1240 1132 cmd.exe attrib.exe PID 1132 wrote to memory of 1240 1132 cmd.exe attrib.exe PID 1132 wrote to memory of 1240 1132 cmd.exe attrib.exe PID 1840 wrote to memory of 844 1840 cmd.exe reg.exe PID 1840 wrote to memory of 844 1840 cmd.exe reg.exe PID 1840 wrote to memory of 844 1840 cmd.exe reg.exe PID 1840 wrote to memory of 844 1840 cmd.exe reg.exe PID 1460 wrote to memory of 1624 1460 taskeng.exe CompPkgSup.exe PID 1460 wrote to memory of 1624 1460 taskeng.exe CompPkgSup.exe PID 1460 wrote to memory of 1624 1460 taskeng.exe CompPkgSup.exe PID 1460 wrote to memory of 1624 1460 taskeng.exe CompPkgSup.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1240 attrib.exe 1672 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe"C:\Users\Admin\AppData\Local\Temp\833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /F /IM CompPkgSup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM CompPkgSup.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ATTRIB +h +s C:\ProgramData\ComponentUpdater2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeATTRIB +h +s C:\ProgramData\ComponentUpdater3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ATTRIB +h +s C:\ProgramData\ComponentUpdater\CompPkgSup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeATTRIB +h +s C:\ProgramData\ComponentUpdater\CompPkgSup.exe3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "PackagesSupport" /tr "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "PackagesSupport" /d "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "PackagesSupport" /d "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\system32\taskeng.exetaskeng.exe {5201D588-45AA-4A18-AB8E-55A0D645252F} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeC:\ProgramData\ComponentUpdater\CompPkgSup.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeFilesize
3.4MB
MD5b4fe4d2ea25842e9e9bb863d330f49ab
SHA132f87e90e1ed0362bd2b8bf2d852c53005adc664
SHA256833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7
SHA512430cd1cdce7bc8f44094f1c642f16c5578c1d16dcbcb3feed24bc34cc469a9a63bb6c6ed71e4f9ebaf339b8a67c0f52b9fde74e35415d4ae86313b2e5f2c8952
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeFilesize
3.4MB
MD5b4fe4d2ea25842e9e9bb863d330f49ab
SHA132f87e90e1ed0362bd2b8bf2d852c53005adc664
SHA256833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7
SHA512430cd1cdce7bc8f44094f1c642f16c5578c1d16dcbcb3feed24bc34cc469a9a63bb6c6ed71e4f9ebaf339b8a67c0f52b9fde74e35415d4ae86313b2e5f2c8952
-
memory/560-58-0x0000000000000000-mapping.dmp
-
memory/652-55-0x00000000012D0000-0x00000000017D8000-memory.dmpFilesize
5.0MB
-
memory/652-54-0x0000000074ED1000-0x0000000074ED3000-memory.dmpFilesize
8KB
-
memory/844-66-0x0000000000000000-mapping.dmp
-
memory/1132-61-0x0000000000000000-mapping.dmp
-
memory/1240-65-0x0000000000000000-mapping.dmp
-
memory/1536-60-0x0000000000000000-mapping.dmp
-
memory/1548-59-0x0000000000000000-mapping.dmp
-
memory/1560-62-0x0000000000000000-mapping.dmp
-
memory/1624-68-0x0000000000000000-mapping.dmp
-
memory/1624-71-0x0000000000AB0000-0x0000000000FB8000-memory.dmpFilesize
5.0MB
-
memory/1672-64-0x0000000000000000-mapping.dmp
-
memory/1840-63-0x0000000000000000-mapping.dmp