Analysis
-
max time kernel
136s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 21:31
Static task
static1
Behavioral task
behavioral1
Sample
c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe
Resource
win10v2004-20220901-en
General
-
Target
c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe
-
Size
285KB
-
MD5
2dfc663706536acc450cc1d76f6eaa93
-
SHA1
c40cd530b455d93347e7eb1862c201d8a1c22720
-
SHA256
c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9
-
SHA512
b1675eae1301c14bfc47a8b46b5b4c2124475697ba6f214ad2134f4b05080a38ebd82310949d8a3f7a7ebec39a5a2ec7dd541a7685e89103382861bf182b0e77
-
SSDEEP
6144:dbkd8IlEOt3VKpSu7STQOPX8NANAqQvt595FA1ZO:Od8ICOt3cpv7Z5NASqQvt0O
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
wmpad64.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile wmpad64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications wmpad64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpad64.exe = "C:\\Windows\\SysWOW64\\wmpad64.exe:*:Enabled:Windows Media App" wmpad64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpad64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile wmpad64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications wmpad64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpad64.exe = "C:\\Windows\\SysWOW64\\wmpad64.exe:*:Enabled:Windows Media App" wmpad64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpad64.exe -
Executes dropped EXE 2 IoCs
Processes:
wmpad64.exewmpad64.exepid process 668 wmpad64.exe 3136 wmpad64.exe -
Sets file execution options in registry 2 TTPs 6 IoCs
Processes:
wmpad64.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe wmpad64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "CMD /C>null" wmpad64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe wmpad64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "CMD /C>null" wmpad64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epplauncher.exe wmpad64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epplauncher.exe\Debugger = "CMD /C>null" wmpad64.exe -
Processes:
resource yara_rule behavioral2/memory/4780-133-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4780-135-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4780-136-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4780-137-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/4780-141-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3136-146-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3136-147-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3136-148-0x0000000000400000-0x0000000000463000-memory.dmp upx behavioral2/memory/3136-149-0x0000000000400000-0x0000000000463000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wmpad64.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wmpad64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Media App = "C:\\Windows\\SysWOW64\\wmpad64.exe" wmpad64.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wmpad64.exec9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpad64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpad64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe -
Drops file in System32 directory 5 IoCs
Processes:
c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exewmpad64.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe File opened for modification C:\Windows\SysWOW64\wmpad64.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe File created C:\Windows\SysWOW64\wmpad64.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe File opened for modification C:\Windows\SysWOW64\ wmpad64.exe File opened for modification C:\Windows\SysWOW64\wmpad64.exe wmpad64.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exewmpad64.exedescription pid process target process PID 2368 set thread context of 4780 2368 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe PID 668 set thread context of 3136 668 wmpad64.exe wmpad64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exewmpad64.exepid process 4780 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe 4780 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe 4780 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe 4780 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe 3136 wmpad64.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exec9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exewmpad64.exewmpad64.exedescription pid process target process PID 2368 wrote to memory of 4780 2368 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe PID 2368 wrote to memory of 4780 2368 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe PID 2368 wrote to memory of 4780 2368 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe PID 2368 wrote to memory of 4780 2368 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe PID 2368 wrote to memory of 4780 2368 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe PID 2368 wrote to memory of 4780 2368 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe PID 2368 wrote to memory of 4780 2368 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe PID 2368 wrote to memory of 4780 2368 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe PID 4780 wrote to memory of 668 4780 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe wmpad64.exe PID 4780 wrote to memory of 668 4780 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe wmpad64.exe PID 4780 wrote to memory of 668 4780 c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe wmpad64.exe PID 668 wrote to memory of 3136 668 wmpad64.exe wmpad64.exe PID 668 wrote to memory of 3136 668 wmpad64.exe wmpad64.exe PID 668 wrote to memory of 3136 668 wmpad64.exe wmpad64.exe PID 668 wrote to memory of 3136 668 wmpad64.exe wmpad64.exe PID 668 wrote to memory of 3136 668 wmpad64.exe wmpad64.exe PID 668 wrote to memory of 3136 668 wmpad64.exe wmpad64.exe PID 668 wrote to memory of 3136 668 wmpad64.exe wmpad64.exe PID 668 wrote to memory of 3136 668 wmpad64.exe wmpad64.exe PID 3136 wrote to memory of 760 3136 wmpad64.exe Explorer.EXE PID 3136 wrote to memory of 760 3136 wmpad64.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe"C:\Users\Admin\AppData\Local\Temp\c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe"C:\Users\Admin\AppData\Local\Temp\c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpad64.exe"C:\Windows\SysWOW64\wmpad64.exe" C:\Users\Admin\AppData\Local\Temp\C9D263~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpad64.exe"C:\Windows\SysWOW64\wmpad64.exe" C:\Users\Admin\AppData\Local\Temp\C9D263~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmpad64.exeFilesize
285KB
MD52dfc663706536acc450cc1d76f6eaa93
SHA1c40cd530b455d93347e7eb1862c201d8a1c22720
SHA256c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9
SHA512b1675eae1301c14bfc47a8b46b5b4c2124475697ba6f214ad2134f4b05080a38ebd82310949d8a3f7a7ebec39a5a2ec7dd541a7685e89103382861bf182b0e77
-
C:\Windows\SysWOW64\wmpad64.exeFilesize
285KB
MD52dfc663706536acc450cc1d76f6eaa93
SHA1c40cd530b455d93347e7eb1862c201d8a1c22720
SHA256c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9
SHA512b1675eae1301c14bfc47a8b46b5b4c2124475697ba6f214ad2134f4b05080a38ebd82310949d8a3f7a7ebec39a5a2ec7dd541a7685e89103382861bf182b0e77
-
C:\Windows\SysWOW64\wmpad64.exeFilesize
285KB
MD52dfc663706536acc450cc1d76f6eaa93
SHA1c40cd530b455d93347e7eb1862c201d8a1c22720
SHA256c9d263a51b77be5af25bbf4f9caa01e81ddb965ebb369df4fa704d4a059affd9
SHA512b1675eae1301c14bfc47a8b46b5b4c2124475697ba6f214ad2134f4b05080a38ebd82310949d8a3f7a7ebec39a5a2ec7dd541a7685e89103382861bf182b0e77
-
memory/668-138-0x0000000000000000-mapping.dmp
-
memory/3136-142-0x0000000000000000-mapping.dmp
-
memory/3136-146-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/3136-147-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/3136-148-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/3136-149-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/4780-137-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/4780-136-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/4780-135-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/4780-141-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/4780-132-0x0000000000000000-mapping.dmp
-
memory/4780-133-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB