Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 03:26
Static task
static1
Behavioral task
behavioral1
Sample
e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe
Resource
win10v2004-20221111-en
General
-
Target
e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe
-
Size
242KB
-
MD5
685ced71365f0dc66285fad77c8be101
-
SHA1
f1ccb96b94e1aeb9ae663c9e6e3452f1b7792be4
-
SHA256
e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e
-
SHA512
7c8b9baf56cec99c9cc7396e52ac4aefc85a4cb81a6ab37f4d7c3c04a368a26050decf214a2fcbc0ccf8a35054cd59988a4446283a5f823dcff90246e84001c7
-
SSDEEP
3072:4Zdm54ZB1O/1+0Lj30nxHP6NinYnpC5e6WmBd9tR6FhGM5+1HQcgWkHYvLEbj2zj:YHMZLj3shMinYnpJvgntmreJgWk9
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
wmpth64.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpth64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpth64.exe = "C:\\Windows\\SysWOW64\\wmpth64.exe:*:Enabled:Windows Media Task" wmpth64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpth64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpth64.exe = "C:\\Windows\\SysWOW64\\wmpth64.exe:*:Enabled:Windows Media Task" wmpth64.exe -
Executes dropped EXE 2 IoCs
Processes:
wmpth64.exewmpth64.exepid process 676 wmpth64.exe 1428 wmpth64.exe -
Processes:
resource yara_rule behavioral1/memory/1284-55-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1284-57-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1284-58-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1284-60-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1284-64-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1284-65-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1284-66-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1284-67-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1284-72-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1428-85-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1428-86-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1428-87-0x0000000000400000-0x0000000000461000-memory.dmp upx behavioral1/memory/1428-88-0x0000000000400000-0x0000000000461000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
wmpth64.exepid process 1428 wmpth64.exe -
Loads dropped DLL 2 IoCs
Processes:
e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exepid process 1284 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe 1284 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wmpth64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Media Task = "C:\\Windows\\SysWOW64\\wmpth64.exe" wmpth64.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wmpth64.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exewmpth64.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpth64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpth64.exe -
Drops file in System32 directory 5 IoCs
Processes:
e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exewmpth64.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe File opened for modification C:\Windows\SysWOW64\wmpth64.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe File created C:\Windows\SysWOW64\wmpth64.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe File opened for modification C:\Windows\SysWOW64\ wmpth64.exe File opened for modification C:\Windows\SysWOW64\wmpth64.exe wmpth64.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exewmpth64.exedescription pid process target process PID 1740 set thread context of 1284 1740 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe PID 676 set thread context of 1428 676 wmpth64.exe wmpth64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exewmpth64.exepid process 1284 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe 1284 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe 1428 wmpth64.exe 1428 wmpth64.exe 1428 wmpth64.exe 1428 wmpth64.exe 1428 wmpth64.exe 1428 wmpth64.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exee594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exewmpth64.exewmpth64.exedescription pid process target process PID 1740 wrote to memory of 1284 1740 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe PID 1740 wrote to memory of 1284 1740 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe PID 1740 wrote to memory of 1284 1740 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe PID 1740 wrote to memory of 1284 1740 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe PID 1740 wrote to memory of 1284 1740 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe PID 1740 wrote to memory of 1284 1740 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe PID 1740 wrote to memory of 1284 1740 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe PID 1740 wrote to memory of 1284 1740 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe PID 1284 wrote to memory of 676 1284 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe wmpth64.exe PID 1284 wrote to memory of 676 1284 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe wmpth64.exe PID 1284 wrote to memory of 676 1284 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe wmpth64.exe PID 1284 wrote to memory of 676 1284 e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe wmpth64.exe PID 676 wrote to memory of 1428 676 wmpth64.exe wmpth64.exe PID 676 wrote to memory of 1428 676 wmpth64.exe wmpth64.exe PID 676 wrote to memory of 1428 676 wmpth64.exe wmpth64.exe PID 676 wrote to memory of 1428 676 wmpth64.exe wmpth64.exe PID 676 wrote to memory of 1428 676 wmpth64.exe wmpth64.exe PID 676 wrote to memory of 1428 676 wmpth64.exe wmpth64.exe PID 676 wrote to memory of 1428 676 wmpth64.exe wmpth64.exe PID 676 wrote to memory of 1428 676 wmpth64.exe wmpth64.exe PID 1428 wrote to memory of 1204 1428 wmpth64.exe Explorer.EXE PID 1428 wrote to memory of 1204 1428 wmpth64.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe"C:\Users\Admin\AppData\Local\Temp\e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe"C:\Users\Admin\AppData\Local\Temp\e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e.exe"3⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpth64.exe"C:\Windows\SysWOW64\wmpth64.exe" C:\Users\Admin\AppData\Local\Temp\E594BC~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpth64.exe"C:\Windows\SysWOW64\wmpth64.exe" C:\Users\Admin\AppData\Local\Temp\E594BC~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmpth64.exeFilesize
242KB
MD5685ced71365f0dc66285fad77c8be101
SHA1f1ccb96b94e1aeb9ae663c9e6e3452f1b7792be4
SHA256e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e
SHA5127c8b9baf56cec99c9cc7396e52ac4aefc85a4cb81a6ab37f4d7c3c04a368a26050decf214a2fcbc0ccf8a35054cd59988a4446283a5f823dcff90246e84001c7
-
C:\Windows\SysWOW64\wmpth64.exeFilesize
242KB
MD5685ced71365f0dc66285fad77c8be101
SHA1f1ccb96b94e1aeb9ae663c9e6e3452f1b7792be4
SHA256e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e
SHA5127c8b9baf56cec99c9cc7396e52ac4aefc85a4cb81a6ab37f4d7c3c04a368a26050decf214a2fcbc0ccf8a35054cd59988a4446283a5f823dcff90246e84001c7
-
C:\Windows\SysWOW64\wmpth64.exeFilesize
242KB
MD5685ced71365f0dc66285fad77c8be101
SHA1f1ccb96b94e1aeb9ae663c9e6e3452f1b7792be4
SHA256e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e
SHA5127c8b9baf56cec99c9cc7396e52ac4aefc85a4cb81a6ab37f4d7c3c04a368a26050decf214a2fcbc0ccf8a35054cd59988a4446283a5f823dcff90246e84001c7
-
\Windows\SysWOW64\wmpth64.exeFilesize
242KB
MD5685ced71365f0dc66285fad77c8be101
SHA1f1ccb96b94e1aeb9ae663c9e6e3452f1b7792be4
SHA256e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e
SHA5127c8b9baf56cec99c9cc7396e52ac4aefc85a4cb81a6ab37f4d7c3c04a368a26050decf214a2fcbc0ccf8a35054cd59988a4446283a5f823dcff90246e84001c7
-
\Windows\SysWOW64\wmpth64.exeFilesize
242KB
MD5685ced71365f0dc66285fad77c8be101
SHA1f1ccb96b94e1aeb9ae663c9e6e3452f1b7792be4
SHA256e594bc9977776c0d9f625ebbfcc689441252171e726fb153a5160f5b1fda911e
SHA5127c8b9baf56cec99c9cc7396e52ac4aefc85a4cb81a6ab37f4d7c3c04a368a26050decf214a2fcbc0ccf8a35054cd59988a4446283a5f823dcff90246e84001c7
-
memory/676-70-0x0000000000000000-mapping.dmp
-
memory/1204-89-0x0000000002AB0000-0x0000000002ACE000-memory.dmpFilesize
120KB
-
memory/1284-58-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1284-61-0x00000000004504E0-mapping.dmp
-
memory/1284-72-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1284-67-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1284-57-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1284-54-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1284-60-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1284-64-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1284-66-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1284-65-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1284-63-0x0000000075931000-0x0000000075933000-memory.dmpFilesize
8KB
-
memory/1284-55-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1428-85-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1428-86-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1428-87-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1428-88-0x0000000000400000-0x0000000000461000-memory.dmpFilesize
388KB
-
memory/1428-81-0x00000000004504E0-mapping.dmp