Analysis
-
max time kernel
138s -
max time network
109s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 06:58
Static task
static1
Behavioral task
behavioral1
Sample
b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe
Resource
win10v2004-20221111-en
General
-
Target
b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe
-
Size
255KB
-
MD5
45f85a3e733cf2c004b43088103a63d5
-
SHA1
c225842823dace2bbd8e9cc1f43a7a18baa7f826
-
SHA256
b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15
-
SHA512
03a23c84db84b9a17a1806b20d8198e701a6d1287872aea9b7762ca0095e5baf66a5bd9eca7e2343ac3b92bcefedc33f511b8774b1b83417999c0c3453b57729
-
SSDEEP
3072:1/wQZtZRx5Jx0Lm2U3FEwAXDLXZAXT7xbRk2B:1dv3Umt6XDVAXJRf
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
wmpdr64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpdr64.exe = "C:\\Windows\\SysWOW64\\wmpdr64.exe:*:Enabled:Windows Media Driver" wmpdr64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpdr64.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpdr64.exe = "C:\\Windows\\SysWOW64\\wmpdr64.exe:*:Enabled:Windows Media Driver" wmpdr64.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpdr64.exe -
Executes dropped EXE 2 IoCs
Processes:
wmpdr64.exewmpdr64.exepid process 1728 wmpdr64.exe 1976 wmpdr64.exe -
Processes:
resource yara_rule behavioral1/memory/744-55-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/744-57-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/744-58-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/744-60-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/744-64-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/744-65-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/744-66-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/744-67-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/744-72-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/1976-85-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/1976-86-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/1976-87-0x0000000000400000-0x0000000000464000-memory.dmp upx behavioral1/memory/1976-88-0x0000000000400000-0x0000000000464000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
wmpdr64.exepid process 1976 wmpdr64.exe -
Loads dropped DLL 2 IoCs
Processes:
b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exepid process 744 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe 744 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wmpdr64.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wmpdr64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Media Driver = "C:\\Windows\\SysWOW64\\wmpdr64.exe" wmpdr64.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exewmpdr64.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpdr64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 wmpdr64.exe -
Drops file in System32 directory 5 IoCs
Processes:
wmpdr64.exeb47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exedescription ioc process File opened for modification C:\Windows\SysWOW64\wmpdr64.exe wmpdr64.exe File opened for modification C:\Windows\SysWOW64\ b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe File opened for modification C:\Windows\SysWOW64\wmpdr64.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe File created C:\Windows\SysWOW64\wmpdr64.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe File opened for modification C:\Windows\SysWOW64\ wmpdr64.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exewmpdr64.exedescription pid process target process PID 1660 set thread context of 744 1660 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe PID 1728 set thread context of 1976 1728 wmpdr64.exe wmpdr64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exewmpdr64.exepid process 744 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe 744 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe 1976 wmpdr64.exe 1976 wmpdr64.exe 1976 wmpdr64.exe 1976 wmpdr64.exe 1976 wmpdr64.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exeb47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exewmpdr64.exewmpdr64.exedescription pid process target process PID 1660 wrote to memory of 744 1660 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe PID 1660 wrote to memory of 744 1660 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe PID 1660 wrote to memory of 744 1660 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe PID 1660 wrote to memory of 744 1660 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe PID 1660 wrote to memory of 744 1660 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe PID 1660 wrote to memory of 744 1660 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe PID 1660 wrote to memory of 744 1660 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe PID 1660 wrote to memory of 744 1660 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe PID 744 wrote to memory of 1728 744 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe wmpdr64.exe PID 744 wrote to memory of 1728 744 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe wmpdr64.exe PID 744 wrote to memory of 1728 744 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe wmpdr64.exe PID 744 wrote to memory of 1728 744 b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe wmpdr64.exe PID 1728 wrote to memory of 1976 1728 wmpdr64.exe wmpdr64.exe PID 1728 wrote to memory of 1976 1728 wmpdr64.exe wmpdr64.exe PID 1728 wrote to memory of 1976 1728 wmpdr64.exe wmpdr64.exe PID 1728 wrote to memory of 1976 1728 wmpdr64.exe wmpdr64.exe PID 1728 wrote to memory of 1976 1728 wmpdr64.exe wmpdr64.exe PID 1728 wrote to memory of 1976 1728 wmpdr64.exe wmpdr64.exe PID 1728 wrote to memory of 1976 1728 wmpdr64.exe wmpdr64.exe PID 1728 wrote to memory of 1976 1728 wmpdr64.exe wmpdr64.exe PID 1976 wrote to memory of 1376 1976 wmpdr64.exe Explorer.EXE PID 1976 wrote to memory of 1376 1976 wmpdr64.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe"C:\Users\Admin\AppData\Local\Temp\b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe"C:\Users\Admin\AppData\Local\Temp\b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15.exe"3⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdr64.exe"C:\Windows\SysWOW64\wmpdr64.exe" C:\Users\Admin\AppData\Local\Temp\B47E29~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpdr64.exe"C:\Windows\SysWOW64\wmpdr64.exe" C:\Users\Admin\AppData\Local\Temp\B47E29~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmpdr64.exeFilesize
255KB
MD545f85a3e733cf2c004b43088103a63d5
SHA1c225842823dace2bbd8e9cc1f43a7a18baa7f826
SHA256b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15
SHA51203a23c84db84b9a17a1806b20d8198e701a6d1287872aea9b7762ca0095e5baf66a5bd9eca7e2343ac3b92bcefedc33f511b8774b1b83417999c0c3453b57729
-
C:\Windows\SysWOW64\wmpdr64.exeFilesize
255KB
MD545f85a3e733cf2c004b43088103a63d5
SHA1c225842823dace2bbd8e9cc1f43a7a18baa7f826
SHA256b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15
SHA51203a23c84db84b9a17a1806b20d8198e701a6d1287872aea9b7762ca0095e5baf66a5bd9eca7e2343ac3b92bcefedc33f511b8774b1b83417999c0c3453b57729
-
C:\Windows\SysWOW64\wmpdr64.exeFilesize
255KB
MD545f85a3e733cf2c004b43088103a63d5
SHA1c225842823dace2bbd8e9cc1f43a7a18baa7f826
SHA256b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15
SHA51203a23c84db84b9a17a1806b20d8198e701a6d1287872aea9b7762ca0095e5baf66a5bd9eca7e2343ac3b92bcefedc33f511b8774b1b83417999c0c3453b57729
-
\Windows\SysWOW64\wmpdr64.exeFilesize
255KB
MD545f85a3e733cf2c004b43088103a63d5
SHA1c225842823dace2bbd8e9cc1f43a7a18baa7f826
SHA256b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15
SHA51203a23c84db84b9a17a1806b20d8198e701a6d1287872aea9b7762ca0095e5baf66a5bd9eca7e2343ac3b92bcefedc33f511b8774b1b83417999c0c3453b57729
-
\Windows\SysWOW64\wmpdr64.exeFilesize
255KB
MD545f85a3e733cf2c004b43088103a63d5
SHA1c225842823dace2bbd8e9cc1f43a7a18baa7f826
SHA256b47e29f6b76061bec34bfdc67d6ffafbb8b25c5a97c027e23bedb36b7d10ee15
SHA51203a23c84db84b9a17a1806b20d8198e701a6d1287872aea9b7762ca0095e5baf66a5bd9eca7e2343ac3b92bcefedc33f511b8774b1b83417999c0c3453b57729
-
memory/744-60-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/744-67-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/744-64-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/744-65-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/744-66-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/744-61-0x000000000044F450-mapping.dmp
-
memory/744-57-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/744-54-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/744-58-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/744-63-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/744-72-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/744-55-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1376-89-0x0000000002720000-0x000000000273E000-memory.dmpFilesize
120KB
-
memory/1728-70-0x0000000000000000-mapping.dmp
-
memory/1976-81-0x000000000044F450-mapping.dmp
-
memory/1976-85-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1976-86-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1976-87-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1976-88-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB