Analysis
-
max time kernel
161s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 02:56
Static task
static1
Behavioral task
behavioral1
Sample
f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe
Resource
win10v2004-20220812-en
General
-
Target
f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe
-
Size
260KB
-
MD5
d06bfa27038a36e86d8b929f21f3baba
-
SHA1
c0d6832da223c06fa51a54a72e60334b68c11439
-
SHA256
f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570
-
SHA512
73753e84fc8a61de0a9628825a5baa5e9fb6d8fad880d85a417cec14a45a90827d1525f4678dacae07fc89f5dfd7f60ed099296b7f841f6865d08ce92db80038
-
SSDEEP
3072:aaVG1jiGIoDclTE2lgfUQCAVtIFhYu/UD6Iv3iuJw+u5UBidlQCCKNYEJd8vnvy:ap4poDeA5fnVtghYuBEiYqU/C5OEwvv
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
wmprk64.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmprk64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmprk64.exe = "C:\\Windows\\SysWOW64\\wmprk64.exe:*:Enabled:Windows Home Media" wmprk64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmprk64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmprk64.exe = "C:\\Windows\\SysWOW64\\wmprk64.exe:*:Enabled:Windows Home Media" wmprk64.exe -
Executes dropped EXE 2 IoCs
Processes:
wmprk64.exewmprk64.exepid process 2004 wmprk64.exe 376 wmprk64.exe -
Sets file execution options in registry 2 TTPs 8 IoCs
Processes:
wmprk64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "CMD /C>null" wmprk64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe wmprk64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "CMD /C>null" wmprk64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe wmprk64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "CMD /C>null" wmprk64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epplauncher.exe wmprk64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\epplauncher.exe\Debugger = "CMD /C>null" wmprk64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe wmprk64.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
wmprk64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MsMpSvc\ImagePath = "CMD /C>null" wmprk64.exe -
Processes:
resource yara_rule behavioral1/memory/1600-55-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1600-57-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1600-58-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1600-60-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1600-64-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1600-65-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1600-66-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1600-67-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1600-72-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/376-85-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/376-86-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/376-87-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/376-88-0x0000000000400000-0x0000000000461000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
wmprk64.exepid process 376 wmprk64.exe -
Loads dropped DLL 2 IoCs
Processes:
f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exepid process 1600 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe 1600 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wmprk64.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wmprk64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Home Media = "C:\\Windows\\SysWOW64\\wmprk64.exe" wmprk64.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exewmprk64.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmprk64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmprk64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe -
Drops file in System32 directory 5 IoCs
Processes:
f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exewmprk64.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe File opened for modification C:\Windows\SysWOW64\wmprk64.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe File created C:\Windows\SysWOW64\wmprk64.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe File opened for modification C:\Windows\SysWOW64\ wmprk64.exe File opened for modification C:\Windows\SysWOW64\wmprk64.exe wmprk64.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exewmprk64.exedescription pid process target process PID 1740 set thread context of 1600 1740 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe PID 2004 set thread context of 376 2004 wmprk64.exe wmprk64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exewmprk64.exepid process 1600 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe 1600 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe 376 wmprk64.exe 376 wmprk64.exe 376 wmprk64.exe 376 wmprk64.exe 376 wmprk64.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exef1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exewmprk64.exewmprk64.exedescription pid process target process PID 1740 wrote to memory of 1600 1740 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe PID 1740 wrote to memory of 1600 1740 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe PID 1740 wrote to memory of 1600 1740 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe PID 1740 wrote to memory of 1600 1740 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe PID 1740 wrote to memory of 1600 1740 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe PID 1740 wrote to memory of 1600 1740 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe PID 1740 wrote to memory of 1600 1740 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe PID 1740 wrote to memory of 1600 1740 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe PID 1600 wrote to memory of 2004 1600 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe wmprk64.exe PID 1600 wrote to memory of 2004 1600 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe wmprk64.exe PID 1600 wrote to memory of 2004 1600 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe wmprk64.exe PID 1600 wrote to memory of 2004 1600 f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe wmprk64.exe PID 2004 wrote to memory of 376 2004 wmprk64.exe wmprk64.exe PID 2004 wrote to memory of 376 2004 wmprk64.exe wmprk64.exe PID 2004 wrote to memory of 376 2004 wmprk64.exe wmprk64.exe PID 2004 wrote to memory of 376 2004 wmprk64.exe wmprk64.exe PID 2004 wrote to memory of 376 2004 wmprk64.exe wmprk64.exe PID 2004 wrote to memory of 376 2004 wmprk64.exe wmprk64.exe PID 2004 wrote to memory of 376 2004 wmprk64.exe wmprk64.exe PID 2004 wrote to memory of 376 2004 wmprk64.exe wmprk64.exe PID 376 wrote to memory of 1208 376 wmprk64.exe Explorer.EXE PID 376 wrote to memory of 1208 376 wmprk64.exe Explorer.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe"C:\Users\Admin\AppData\Local\Temp\f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe"C:\Users\Admin\AppData\Local\Temp\f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570.exe"2⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmprk64.exe"C:\Windows\SysWOW64\wmprk64.exe" C:\Users\Admin\AppData\Local\Temp\F1CF40~1.EXE3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmprk64.exe"C:\Windows\SysWOW64\wmprk64.exe" C:\Users\Admin\AppData\Local\Temp\F1CF40~1.EXE4⤵
- Modifies firewall policy service
- Executes dropped EXE
- Sets file execution options in registry
- Sets service image path in registry
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmprk64.exeFilesize
260KB
MD5d06bfa27038a36e86d8b929f21f3baba
SHA1c0d6832da223c06fa51a54a72e60334b68c11439
SHA256f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570
SHA51273753e84fc8a61de0a9628825a5baa5e9fb6d8fad880d85a417cec14a45a90827d1525f4678dacae07fc89f5dfd7f60ed099296b7f841f6865d08ce92db80038
-
C:\Windows\SysWOW64\wmprk64.exeFilesize
260KB
MD5d06bfa27038a36e86d8b929f21f3baba
SHA1c0d6832da223c06fa51a54a72e60334b68c11439
SHA256f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570
SHA51273753e84fc8a61de0a9628825a5baa5e9fb6d8fad880d85a417cec14a45a90827d1525f4678dacae07fc89f5dfd7f60ed099296b7f841f6865d08ce92db80038
-
C:\Windows\SysWOW64\wmprk64.exeFilesize
260KB
MD5d06bfa27038a36e86d8b929f21f3baba
SHA1c0d6832da223c06fa51a54a72e60334b68c11439
SHA256f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570
SHA51273753e84fc8a61de0a9628825a5baa5e9fb6d8fad880d85a417cec14a45a90827d1525f4678dacae07fc89f5dfd7f60ed099296b7f841f6865d08ce92db80038
-
\Windows\SysWOW64\wmprk64.exeFilesize
260KB
MD5d06bfa27038a36e86d8b929f21f3baba
SHA1c0d6832da223c06fa51a54a72e60334b68c11439
SHA256f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570
SHA51273753e84fc8a61de0a9628825a5baa5e9fb6d8fad880d85a417cec14a45a90827d1525f4678dacae07fc89f5dfd7f60ed099296b7f841f6865d08ce92db80038
-
\Windows\SysWOW64\wmprk64.exeFilesize
260KB
MD5d06bfa27038a36e86d8b929f21f3baba
SHA1c0d6832da223c06fa51a54a72e60334b68c11439
SHA256f1cf4079dc53f0d1d607ff0bd64bed5e8ec5a0d93889264bcd597d2df4521570
SHA51273753e84fc8a61de0a9628825a5baa5e9fb6d8fad880d85a417cec14a45a90827d1525f4678dacae07fc89f5dfd7f60ed099296b7f841f6865d08ce92db80038
-
memory/376-88-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/376-87-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/376-86-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/376-85-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/376-81-0x0000000000450920-mapping.dmp
-
memory/1208-89-0x00000000021F0000-0x000000000220E000-memory.dmpFilesize
120KB
-
memory/1600-66-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1600-54-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1600-58-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1600-57-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1600-72-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1600-67-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1600-55-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1600-60-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1600-65-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1600-64-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1600-63-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/1600-61-0x0000000000450920-mapping.dmp
-
memory/2004-70-0x0000000000000000-mapping.dmp