Analysis
-
max time kernel
144s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2022 08:38
Static task
static1
Behavioral task
behavioral1
Sample
b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe
Resource
win10v2004-20220812-en
General
-
Target
b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe
-
Size
205KB
-
MD5
857c66a8c57f4f160f83da8a08809531
-
SHA1
3321b31c97f63da5a004cb566d654ccfa4fa5b08
-
SHA256
b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c
-
SHA512
f6fec9e8880102aac18564d3137b7bb34da6cf7715f237739011a34962c655ef64d2847185f9edf2a802a2cf9f833b59f8f3593d2965edd4f839f79ad9ec1195
-
SSDEEP
3072:jlYKvotj2t6M/cL5LlCImS4dXVn5cilIy6fg8z2sgQ2ScTJUjTwRikEwYiUHW:jyaEj2d/cL58IJ+TZmfgi8UnwEkETHW
Malware Config
Extracted
metasploit
encoder/call4_dword_xor
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies firewall policy service 2 TTPs 8 IoCs
Processes:
wmpkl32.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List wmpkl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile wmpkl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications wmpkl32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpkl32.exe = "C:\\Windows\\SysWOW64\\wmpkl32.exe:*:Enabled:WinMedia Services" wmpkl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List wmpkl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile wmpkl32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications wmpkl32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\wmpkl32.exe = "C:\\Windows\\SysWOW64\\wmpkl32.exe:*:Enabled:WinMedia Services" wmpkl32.exe -
Executes dropped EXE 2 IoCs
Processes:
wmpkl32.exewmpkl32.exepid process 4660 wmpkl32.exe 4612 wmpkl32.exe -
Processes:
resource yara_rule behavioral2/memory/4448-133-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4448-135-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4448-136-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4448-137-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4448-141-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4612-148-0x0000000000400000-0x0000000000451000-memory.dmp upx behavioral2/memory/4612-149-0x0000000000400000-0x0000000000451000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wmpkl32.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wmpkl32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinMedia Services = "C:\\Windows\\SysWOW64\\wmpkl32.exe" wmpkl32.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
wmpkl32.exeb218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 wmpkl32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum wmpkl32.exe -
Drops file in System32 directory 4 IoCs
Processes:
b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exewmpkl32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe File opened for modification C:\Windows\SysWOW64\wmpkl32.exe b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe File created C:\Windows\SysWOW64\wmpkl32.exe b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe File opened for modification C:\Windows\SysWOW64\ wmpkl32.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exewmpkl32.exedescription pid process target process PID 916 set thread context of 4448 916 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe PID 4660 set thread context of 4612 4660 wmpkl32.exe wmpkl32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exewmpkl32.exepid process 4448 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe 4448 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe 4448 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe 4448 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe 4612 wmpkl32.exe 4612 wmpkl32.exe 4612 wmpkl32.exe 4612 wmpkl32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exeb218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exewmpkl32.exewmpkl32.exedescription pid process target process PID 916 wrote to memory of 4448 916 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe PID 916 wrote to memory of 4448 916 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe PID 916 wrote to memory of 4448 916 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe PID 916 wrote to memory of 4448 916 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe PID 916 wrote to memory of 4448 916 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe PID 916 wrote to memory of 4448 916 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe PID 916 wrote to memory of 4448 916 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe PID 4448 wrote to memory of 4660 4448 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe wmpkl32.exe PID 4448 wrote to memory of 4660 4448 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe wmpkl32.exe PID 4448 wrote to memory of 4660 4448 b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe wmpkl32.exe PID 4660 wrote to memory of 4612 4660 wmpkl32.exe wmpkl32.exe PID 4660 wrote to memory of 4612 4660 wmpkl32.exe wmpkl32.exe PID 4660 wrote to memory of 4612 4660 wmpkl32.exe wmpkl32.exe PID 4660 wrote to memory of 4612 4660 wmpkl32.exe wmpkl32.exe PID 4660 wrote to memory of 4612 4660 wmpkl32.exe wmpkl32.exe PID 4660 wrote to memory of 4612 4660 wmpkl32.exe wmpkl32.exe PID 4660 wrote to memory of 4612 4660 wmpkl32.exe wmpkl32.exe PID 4612 wrote to memory of 512 4612 wmpkl32.exe Explorer.EXE PID 4612 wrote to memory of 512 4612 wmpkl32.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe"C:\Users\Admin\AppData\Local\Temp\b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe"C:\Users\Admin\AppData\Local\Temp\b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c.exe"3⤵
- Checks computer location settings
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpkl32.exe"C:\Windows\SysWOW64\wmpkl32.exe" C:\Users\Admin\AppData\Local\Temp\B21851~1.EXE4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wmpkl32.exe"C:\Windows\SysWOW64\wmpkl32.exe" C:\Users\Admin\AppData\Local\Temp\B21851~1.EXE5⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\wmpkl32.exeFilesize
205KB
MD5857c66a8c57f4f160f83da8a08809531
SHA13321b31c97f63da5a004cb566d654ccfa4fa5b08
SHA256b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c
SHA512f6fec9e8880102aac18564d3137b7bb34da6cf7715f237739011a34962c655ef64d2847185f9edf2a802a2cf9f833b59f8f3593d2965edd4f839f79ad9ec1195
-
C:\Windows\SysWOW64\wmpkl32.exeFilesize
205KB
MD5857c66a8c57f4f160f83da8a08809531
SHA13321b31c97f63da5a004cb566d654ccfa4fa5b08
SHA256b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c
SHA512f6fec9e8880102aac18564d3137b7bb34da6cf7715f237739011a34962c655ef64d2847185f9edf2a802a2cf9f833b59f8f3593d2965edd4f839f79ad9ec1195
-
C:\Windows\SysWOW64\wmpkl32.exeFilesize
205KB
MD5857c66a8c57f4f160f83da8a08809531
SHA13321b31c97f63da5a004cb566d654ccfa4fa5b08
SHA256b218513df15724b38ded71d19a51e43f657512b6e960abc093fad4f028a8ae5c
SHA512f6fec9e8880102aac18564d3137b7bb34da6cf7715f237739011a34962c655ef64d2847185f9edf2a802a2cf9f833b59f8f3593d2965edd4f839f79ad9ec1195
-
memory/4448-136-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4448-137-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4448-132-0x0000000000000000-mapping.dmp
-
memory/4448-135-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4448-141-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4448-133-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4612-142-0x0000000000000000-mapping.dmp
-
memory/4612-148-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4612-149-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4660-138-0x0000000000000000-mapping.dmp