Analysis
-
max time kernel
159s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 10:02
Behavioral task
behavioral1
Sample
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe
Resource
win10v2004-20220812-en
General
-
Target
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe
-
Size
3.4MB
-
MD5
b4fe4d2ea25842e9e9bb863d330f49ab
-
SHA1
32f87e90e1ed0362bd2b8bf2d852c53005adc664
-
SHA256
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7
-
SHA512
430cd1cdce7bc8f44094f1c642f16c5578c1d16dcbcb3feed24bc34cc469a9a63bb6c6ed71e4f9ebaf339b8a67c0f52b9fde74e35415d4ae86313b2e5f2c8952
-
SSDEEP
49152:nj3vbky6xLIy2volN4mVppF4DhbTghyZGEy7rCX26Th1JO0DYpHRKMJnoYEAp7m5:jfbWRdzONbTghIGLfCmY80E5noYE7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CompPkgSup.exepid process 3384 CompPkgSup.exe -
Processes:
resource yara_rule behavioral2/memory/3928-132-0x00000000007C0000-0x0000000000CC8000-memory.dmp vmprotect C:\ProgramData\ComponentUpdater\CompPkgSup.exe vmprotect C:\ProgramData\ComponentUpdater\CompPkgSup.exe vmprotect behavioral2/memory/3384-146-0x0000000000320000-0x0000000000828000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PackagesSupport = "C:\\ProgramData\\ComponentUpdater\\CompPkgSup.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1408 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1408 taskkill.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.execmd.execmd.execmd.execmd.exedescription pid process target process PID 3928 wrote to memory of 3396 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3928 wrote to memory of 3396 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3928 wrote to memory of 3396 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3396 wrote to memory of 1408 3396 cmd.exe taskkill.exe PID 3396 wrote to memory of 1408 3396 cmd.exe taskkill.exe PID 3396 wrote to memory of 1408 3396 cmd.exe taskkill.exe PID 3928 wrote to memory of 3272 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3928 wrote to memory of 3272 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3928 wrote to memory of 3272 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3928 wrote to memory of 3192 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3928 wrote to memory of 3192 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3928 wrote to memory of 3192 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3928 wrote to memory of 5084 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe schtasks.exe PID 3928 wrote to memory of 5084 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe schtasks.exe PID 3928 wrote to memory of 5084 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe schtasks.exe PID 3928 wrote to memory of 220 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3928 wrote to memory of 220 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3928 wrote to memory of 220 3928 833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe cmd.exe PID 3192 wrote to memory of 4136 3192 cmd.exe attrib.exe PID 3192 wrote to memory of 4136 3192 cmd.exe attrib.exe PID 3192 wrote to memory of 4136 3192 cmd.exe attrib.exe PID 3272 wrote to memory of 4724 3272 cmd.exe attrib.exe PID 3272 wrote to memory of 4724 3272 cmd.exe attrib.exe PID 3272 wrote to memory of 4724 3272 cmd.exe attrib.exe PID 220 wrote to memory of 3648 220 cmd.exe reg.exe PID 220 wrote to memory of 3648 220 cmd.exe reg.exe PID 220 wrote to memory of 3648 220 cmd.exe reg.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4136 attrib.exe 4724 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe"C:\Users\Admin\AppData\Local\Temp\833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /F /IM CompPkgSup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM CompPkgSup.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ATTRIB +h +s C:\ProgramData\ComponentUpdater2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeATTRIB +h +s C:\ProgramData\ComponentUpdater3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ATTRIB +h +s C:\ProgramData\ComponentUpdater\CompPkgSup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeATTRIB +h +s C:\ProgramData\ComponentUpdater\CompPkgSup.exe3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "PackagesSupport" /tr "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "PackagesSupport" /d "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "PackagesSupport" /d "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeC:\ProgramData\ComponentUpdater\CompPkgSup.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeFilesize
3.4MB
MD5b4fe4d2ea25842e9e9bb863d330f49ab
SHA132f87e90e1ed0362bd2b8bf2d852c53005adc664
SHA256833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7
SHA512430cd1cdce7bc8f44094f1c642f16c5578c1d16dcbcb3feed24bc34cc469a9a63bb6c6ed71e4f9ebaf339b8a67c0f52b9fde74e35415d4ae86313b2e5f2c8952
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeFilesize
3.4MB
MD5b4fe4d2ea25842e9e9bb863d330f49ab
SHA132f87e90e1ed0362bd2b8bf2d852c53005adc664
SHA256833a95cdebc253a577d61edf6e4aef6873bde45774d4f25256aad1739757dbd7
SHA512430cd1cdce7bc8f44094f1c642f16c5578c1d16dcbcb3feed24bc34cc469a9a63bb6c6ed71e4f9ebaf339b8a67c0f52b9fde74e35415d4ae86313b2e5f2c8952
-
memory/220-140-0x0000000000000000-mapping.dmp
-
memory/1408-136-0x0000000000000000-mapping.dmp
-
memory/3192-138-0x0000000000000000-mapping.dmp
-
memory/3272-137-0x0000000000000000-mapping.dmp
-
memory/3384-146-0x0000000000320000-0x0000000000828000-memory.dmpFilesize
5.0MB
-
memory/3396-135-0x0000000000000000-mapping.dmp
-
memory/3648-144-0x0000000000000000-mapping.dmp
-
memory/3928-132-0x00000000007C0000-0x0000000000CC8000-memory.dmpFilesize
5.0MB
-
memory/4136-141-0x0000000000000000-mapping.dmp
-
memory/4724-142-0x0000000000000000-mapping.dmp
-
memory/5084-139-0x0000000000000000-mapping.dmp