Analysis
-
max time kernel
43s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 10:17
Behavioral task
behavioral1
Sample
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe
Resource
win10v2004-20220901-en
General
-
Target
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe
-
Size
3.3MB
-
MD5
3d33b840b14c77994554604654f656e4
-
SHA1
694101b5227925d39c75a9d306cb5e973aaf2ab4
-
SHA256
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c
-
SHA512
d8f1abed7978d48f13468f678c72df211f572a197de49b6ec551b9dccfb767033b9372cc2cc2b148939f9832dbd59e8a8c6df891458bc1a0f7db398c7cec3a4b
-
SSDEEP
98304:/IAyriVOjVe2MyIVNOU+N46v9javKqQGoLhnTA:/wiJT7NOX4k+CfN0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CompPkgSup.exepid process 2036 CompPkgSup.exe -
Processes:
resource yara_rule behavioral1/memory/784-55-0x00000000003B0000-0x0000000000893000-memory.dmp vmprotect C:\ProgramData\ComponentUpdater\CompPkgSup.exe vmprotect C:\ProgramData\ComponentUpdater\CompPkgSup.exe vmprotect behavioral1/memory/2036-69-0x00000000010A0000-0x0000000001583000-memory.dmp vmprotect -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\PackagesSupport = "C:\\ProgramData\\ComponentUpdater\\CompPkgSup.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1268 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1268 taskkill.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.execmd.execmd.execmd.execmd.exetaskeng.exedescription pid process target process PID 784 wrote to memory of 2004 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 2004 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 2004 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 2004 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 2004 wrote to memory of 1268 2004 cmd.exe taskkill.exe PID 2004 wrote to memory of 1268 2004 cmd.exe taskkill.exe PID 2004 wrote to memory of 1268 2004 cmd.exe taskkill.exe PID 2004 wrote to memory of 1268 2004 cmd.exe taskkill.exe PID 784 wrote to memory of 1720 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 1720 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 1720 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 1720 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 1020 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 1020 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 1020 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 1020 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1020 wrote to memory of 1692 1020 cmd.exe attrib.exe PID 1020 wrote to memory of 1692 1020 cmd.exe attrib.exe PID 1020 wrote to memory of 1692 1020 cmd.exe attrib.exe PID 1020 wrote to memory of 1692 1020 cmd.exe attrib.exe PID 1720 wrote to memory of 520 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 520 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 520 1720 cmd.exe attrib.exe PID 1720 wrote to memory of 520 1720 cmd.exe attrib.exe PID 784 wrote to memory of 1680 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe schtasks.exe PID 784 wrote to memory of 1680 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe schtasks.exe PID 784 wrote to memory of 1680 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe schtasks.exe PID 784 wrote to memory of 1680 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe schtasks.exe PID 784 wrote to memory of 692 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 692 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 692 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 784 wrote to memory of 692 784 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 692 wrote to memory of 1620 692 cmd.exe reg.exe PID 692 wrote to memory of 1620 692 cmd.exe reg.exe PID 692 wrote to memory of 1620 692 cmd.exe reg.exe PID 692 wrote to memory of 1620 692 cmd.exe reg.exe PID 1924 wrote to memory of 2036 1924 taskeng.exe CompPkgSup.exe PID 1924 wrote to memory of 2036 1924 taskeng.exe CompPkgSup.exe PID 1924 wrote to memory of 2036 1924 taskeng.exe CompPkgSup.exe PID 1924 wrote to memory of 2036 1924 taskeng.exe CompPkgSup.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1692 attrib.exe 520 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe"C:\Users\Admin\AppData\Local\Temp\ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /F /IM CompPkgSup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM CompPkgSup.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ATTRIB +h +s C:\ProgramData\ComponentUpdater2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeATTRIB +h +s C:\ProgramData\ComponentUpdater3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ATTRIB +h +s C:\ProgramData\ComponentUpdater\CompPkgSup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeATTRIB +h +s C:\ProgramData\ComponentUpdater\CompPkgSup.exe3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "PackagesSupport" /tr "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "PackagesSupport" /d "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "PackagesSupport" /d "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Windows\system32\taskeng.exetaskeng.exe {D52D3C6C-B28C-4AE9-9197-05C6D76C8C90} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeC:\ProgramData\ComponentUpdater\CompPkgSup.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeFilesize
3.3MB
MD53d33b840b14c77994554604654f656e4
SHA1694101b5227925d39c75a9d306cb5e973aaf2ab4
SHA256ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c
SHA512d8f1abed7978d48f13468f678c72df211f572a197de49b6ec551b9dccfb767033b9372cc2cc2b148939f9832dbd59e8a8c6df891458bc1a0f7db398c7cec3a4b
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeFilesize
3.3MB
MD53d33b840b14c77994554604654f656e4
SHA1694101b5227925d39c75a9d306cb5e973aaf2ab4
SHA256ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c
SHA512d8f1abed7978d48f13468f678c72df211f572a197de49b6ec551b9dccfb767033b9372cc2cc2b148939f9832dbd59e8a8c6df891458bc1a0f7db398c7cec3a4b
-
memory/520-61-0x0000000000000000-mapping.dmp
-
memory/692-63-0x0000000000000000-mapping.dmp
-
memory/784-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB
-
memory/784-55-0x00000000003B0000-0x0000000000893000-memory.dmpFilesize
4.9MB
-
memory/1020-59-0x0000000000000000-mapping.dmp
-
memory/1268-57-0x0000000000000000-mapping.dmp
-
memory/1620-65-0x0000000000000000-mapping.dmp
-
memory/1680-62-0x0000000000000000-mapping.dmp
-
memory/1692-60-0x0000000000000000-mapping.dmp
-
memory/1720-58-0x0000000000000000-mapping.dmp
-
memory/2004-56-0x0000000000000000-mapping.dmp
-
memory/2036-66-0x0000000000000000-mapping.dmp
-
memory/2036-69-0x00000000010A0000-0x0000000001583000-memory.dmpFilesize
4.9MB