Analysis
-
max time kernel
64s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 10:17
Behavioral task
behavioral1
Sample
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe
Resource
win10v2004-20220901-en
General
-
Target
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe
-
Size
3.3MB
-
MD5
3d33b840b14c77994554604654f656e4
-
SHA1
694101b5227925d39c75a9d306cb5e973aaf2ab4
-
SHA256
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c
-
SHA512
d8f1abed7978d48f13468f678c72df211f572a197de49b6ec551b9dccfb767033b9372cc2cc2b148939f9832dbd59e8a8c6df891458bc1a0f7db398c7cec3a4b
-
SSDEEP
98304:/IAyriVOjVe2MyIVNOU+N46v9javKqQGoLhnTA:/wiJT7NOX4k+CfN0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
CompPkgSup.exepid process 4976 CompPkgSup.exe -
Processes:
resource yara_rule behavioral2/memory/1528-132-0x0000000000290000-0x0000000000773000-memory.dmp vmprotect C:\ProgramData\ComponentUpdater\CompPkgSup.exe vmprotect C:\ProgramData\ComponentUpdater\CompPkgSup.exe vmprotect behavioral2/memory/4976-144-0x0000000000E80000-0x0000000001363000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PackagesSupport = "C:\\ProgramData\\ComponentUpdater\\CompPkgSup.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4896 taskkill.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4896 taskkill.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1528 wrote to memory of 4844 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1528 wrote to memory of 4844 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1528 wrote to memory of 4844 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 4844 wrote to memory of 4896 4844 cmd.exe taskkill.exe PID 4844 wrote to memory of 4896 4844 cmd.exe taskkill.exe PID 4844 wrote to memory of 4896 4844 cmd.exe taskkill.exe PID 1528 wrote to memory of 3064 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1528 wrote to memory of 3064 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1528 wrote to memory of 3064 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1528 wrote to memory of 1524 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1528 wrote to memory of 1524 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1528 wrote to memory of 1524 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1528 wrote to memory of 4588 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe schtasks.exe PID 1528 wrote to memory of 4588 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe schtasks.exe PID 1528 wrote to memory of 4588 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe schtasks.exe PID 1528 wrote to memory of 4980 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1528 wrote to memory of 4980 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 1528 wrote to memory of 4980 1528 ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe cmd.exe PID 3064 wrote to memory of 3004 3064 cmd.exe attrib.exe PID 3064 wrote to memory of 3004 3064 cmd.exe attrib.exe PID 3064 wrote to memory of 3004 3064 cmd.exe attrib.exe PID 1524 wrote to memory of 2196 1524 cmd.exe attrib.exe PID 1524 wrote to memory of 2196 1524 cmd.exe attrib.exe PID 1524 wrote to memory of 2196 1524 cmd.exe attrib.exe PID 4980 wrote to memory of 1276 4980 cmd.exe reg.exe PID 4980 wrote to memory of 1276 4980 cmd.exe reg.exe PID 4980 wrote to memory of 1276 4980 cmd.exe reg.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 3004 attrib.exe 2196 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe"C:\Users\Admin\AppData\Local\Temp\ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /F /IM CompPkgSup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM CompPkgSup.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ATTRIB +h +s C:\ProgramData\ComponentUpdater2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeATTRIB +h +s C:\ProgramData\ComponentUpdater3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ATTRIB +h +s C:\ProgramData\ComponentUpdater\CompPkgSup.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeATTRIB +h +s C:\ProgramData\ComponentUpdater\CompPkgSup.exe3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /tn "PackagesSupport" /tr "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "PackagesSupport" /d "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "PackagesSupport" /d "C:\ProgramData\ComponentUpdater\CompPkgSup.exe" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeC:\ProgramData\ComponentUpdater\CompPkgSup.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeFilesize
3.3MB
MD53d33b840b14c77994554604654f656e4
SHA1694101b5227925d39c75a9d306cb5e973aaf2ab4
SHA256ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c
SHA512d8f1abed7978d48f13468f678c72df211f572a197de49b6ec551b9dccfb767033b9372cc2cc2b148939f9832dbd59e8a8c6df891458bc1a0f7db398c7cec3a4b
-
C:\ProgramData\ComponentUpdater\CompPkgSup.exeFilesize
3.3MB
MD53d33b840b14c77994554604654f656e4
SHA1694101b5227925d39c75a9d306cb5e973aaf2ab4
SHA256ea92d269c61a53365455a468e5dd6f01bccc2979a33268dc41552dc46773261c
SHA512d8f1abed7978d48f13468f678c72df211f572a197de49b6ec551b9dccfb767033b9372cc2cc2b148939f9832dbd59e8a8c6df891458bc1a0f7db398c7cec3a4b
-
memory/1276-142-0x0000000000000000-mapping.dmp
-
memory/1524-136-0x0000000000000000-mapping.dmp
-
memory/1528-132-0x0000000000290000-0x0000000000773000-memory.dmpFilesize
4.9MB
-
memory/2196-140-0x0000000000000000-mapping.dmp
-
memory/3004-139-0x0000000000000000-mapping.dmp
-
memory/3064-135-0x0000000000000000-mapping.dmp
-
memory/4588-137-0x0000000000000000-mapping.dmp
-
memory/4844-133-0x0000000000000000-mapping.dmp
-
memory/4896-134-0x0000000000000000-mapping.dmp
-
memory/4976-144-0x0000000000E80000-0x0000000001363000-memory.dmpFilesize
4.9MB
-
memory/4980-138-0x0000000000000000-mapping.dmp