Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 08:06
Static task
static1
Behavioral task
behavioral1
Sample
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe
Resource
win10v2004-20220812-en
General
-
Target
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe
-
Size
260KB
-
MD5
939d220eb5f9d3b8c5d35a975e740127
-
SHA1
c23a5f9a876bfe496b361606759ac9f1aa602638
-
SHA256
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667
-
SHA512
3b17b80a55571313d68fcb97668482d8c867c453a2211c00736bf321fad27bac8e8906e5284e5419d6e5ccc00bda9635c45012398bafa970f7deff8bb03e5ce7
-
SSDEEP
6144:qeN95oTK6nfxa2JftDnYfRa2KPY+0H1XTAgfzDDJXvr:qU95oDa2sfSPE
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
wmprk64.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile wmprk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications wmprk64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmprk64.exe = "C:\\Windows\\SysWOW64\\wmprk64.exe:*:Enabled:Windows Home Media" wmprk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmprk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile wmprk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications wmprk64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmprk64.exe = "C:\\Windows\\SysWOW64\\wmprk64.exe:*:Enabled:Windows Home Media" wmprk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmprk64.exe -
Executes dropped EXE 2 IoCs
Processes:
wmprk64.exewmprk64.exepid process 4932 wmprk64.exe 4564 wmprk64.exe -
Sets file execution options in registry 2 TTPs 8 IoCs
Processes:
wmprk64.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe wmprk64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "CMD /C>null" wmprk64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe wmprk64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "CMD /C>null" wmprk64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epplauncher.exe wmprk64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epplauncher.exe\Debugger = "CMD /C>null" wmprk64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe wmprk64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "CMD /C>null" wmprk64.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
wmprk64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MsMpSvc\ImagePath = "CMD /C>null" wmprk64.exe -
Processes:
resource yara_rule behavioral2/memory/1764-133-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1764-135-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1764-136-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1764-137-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1764-138-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/4564-148-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1764-149-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/4564-150-0x0000000000400000-0x0000000000462000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wmprk64.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wmprk64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Home Media = "C:\\Windows\\SysWOW64\\wmprk64.exe" wmprk64.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exewmprk64.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmprk64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmprk64.exe -
Drops file in System32 directory 5 IoCs
Processes:
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exewmprk64.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wmprk64.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe File created C:\Windows\SysWOW64\wmprk64.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe File opened for modification C:\Windows\SysWOW64\ wmprk64.exe File opened for modification C:\Windows\SysWOW64\wmprk64.exe wmprk64.exe File opened for modification C:\Windows\SysWOW64\ 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exewmprk64.exedescription pid process target process PID 4260 set thread context of 1764 4260 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe PID 4932 set thread context of 4564 4932 wmprk64.exe wmprk64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exewmprk64.exepid process 1764 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 1764 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 1764 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 1764 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe 4564 wmprk64.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exewmprk64.exewmprk64.exedescription pid process target process PID 4260 wrote to memory of 1764 4260 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe PID 4260 wrote to memory of 1764 4260 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe PID 4260 wrote to memory of 1764 4260 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe PID 4260 wrote to memory of 1764 4260 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe PID 4260 wrote to memory of 1764 4260 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe PID 4260 wrote to memory of 1764 4260 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe PID 4260 wrote to memory of 1764 4260 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe PID 4260 wrote to memory of 1764 4260 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe PID 1764 wrote to memory of 4932 1764 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe wmprk64.exe PID 1764 wrote to memory of 4932 1764 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe wmprk64.exe PID 1764 wrote to memory of 4932 1764 6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe wmprk64.exe PID 4932 wrote to memory of 4564 4932 wmprk64.exe wmprk64.exe PID 4932 wrote to memory of 4564 4932 wmprk64.exe wmprk64.exe PID 4932 wrote to memory of 4564 4932 wmprk64.exe wmprk64.exe PID 4932 wrote to memory of 4564 4932 wmprk64.exe wmprk64.exe PID 4932 wrote to memory of 4564 4932 wmprk64.exe wmprk64.exe PID 4932 wrote to memory of 4564 4932 wmprk64.exe wmprk64.exe PID 4932 wrote to memory of 4564 4932 wmprk64.exe wmprk64.exe PID 4932 wrote to memory of 4564 4932 wmprk64.exe wmprk64.exe PID 4564 wrote to memory of 3044 4564 wmprk64.exe Explorer.EXE PID 4564 wrote to memory of 3044 4564 wmprk64.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe"C:\Users\Admin\AppData\Local\Temp\6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe"C:\Users\Admin\AppData\Local\Temp\6ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmprk64.exe"C:\Windows\SysWOW64\wmprk64.exe" C:\Users\Admin\AppData\Local\Temp\6DDCDE~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmprk64.exe"C:\Windows\SysWOW64\wmprk64.exe" C:\Users\Admin\AppData\Local\Temp\6DDCDE~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Sets file execution options in registry
- Sets service image path in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmprk64.exeFilesize
260KB
MD5939d220eb5f9d3b8c5d35a975e740127
SHA1c23a5f9a876bfe496b361606759ac9f1aa602638
SHA2566ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667
SHA5123b17b80a55571313d68fcb97668482d8c867c453a2211c00736bf321fad27bac8e8906e5284e5419d6e5ccc00bda9635c45012398bafa970f7deff8bb03e5ce7
-
C:\Windows\SysWOW64\wmprk64.exeFilesize
260KB
MD5939d220eb5f9d3b8c5d35a975e740127
SHA1c23a5f9a876bfe496b361606759ac9f1aa602638
SHA2566ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667
SHA5123b17b80a55571313d68fcb97668482d8c867c453a2211c00736bf321fad27bac8e8906e5284e5419d6e5ccc00bda9635c45012398bafa970f7deff8bb03e5ce7
-
C:\Windows\SysWOW64\wmprk64.exeFilesize
260KB
MD5939d220eb5f9d3b8c5d35a975e740127
SHA1c23a5f9a876bfe496b361606759ac9f1aa602638
SHA2566ddcdecc111152874195e0f43fbd533672361077b6e3365c44efa4ca57390667
SHA5123b17b80a55571313d68fcb97668482d8c867c453a2211c00736bf321fad27bac8e8906e5284e5419d6e5ccc00bda9635c45012398bafa970f7deff8bb03e5ce7
-
memory/1764-136-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1764-137-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1764-138-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1764-132-0x0000000000000000-mapping.dmp
-
memory/1764-135-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1764-133-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1764-149-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/4564-142-0x0000000000000000-mapping.dmp
-
memory/4564-148-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/4564-150-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/4932-139-0x0000000000000000-mapping.dmp