Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 07:49
Static task
static1
Behavioral task
behavioral1
Sample
45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe
Resource
win10-en-20211208
General
-
Target
45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe
-
Size
270KB
-
MD5
67abef7218b3cc16b6cb7177643c1886
-
SHA1
2026aac881ee7a6d32b30e1b0cc326bb618db878
-
SHA256
45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e
-
SHA512
18ab11ac2a12995515f5480b837d20fc9c1ce9103fe2aa2bc0c325f8d67c576483fe9a69ae9027d8a0db3a30f3dfed2f2a38175b63032ecbcc6e7cec1f72a136
Malware Config
Extracted
tofsee
patmushta.info
ovicrush.cn
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
wvojcrlv.exepid process 4080 wvojcrlv.exe -
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2828 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wvojcrlv.exedescription pid process target process PID 4080 set thread context of 2828 4080 wvojcrlv.exe svchost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exewvojcrlv.exedescription pid process target process PID 2224 wrote to memory of 3152 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe cmd.exe PID 2224 wrote to memory of 3152 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe cmd.exe PID 2224 wrote to memory of 3152 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe cmd.exe PID 2224 wrote to memory of 3700 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe cmd.exe PID 2224 wrote to memory of 3700 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe cmd.exe PID 2224 wrote to memory of 3700 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe cmd.exe PID 2224 wrote to memory of 648 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe sc.exe PID 2224 wrote to memory of 648 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe sc.exe PID 2224 wrote to memory of 648 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe sc.exe PID 2224 wrote to memory of 2004 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe sc.exe PID 2224 wrote to memory of 2004 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe sc.exe PID 2224 wrote to memory of 2004 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe sc.exe PID 2224 wrote to memory of 584 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe sc.exe PID 2224 wrote to memory of 584 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe sc.exe PID 2224 wrote to memory of 584 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe sc.exe PID 2224 wrote to memory of 3952 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe netsh.exe PID 2224 wrote to memory of 3952 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe netsh.exe PID 2224 wrote to memory of 3952 2224 45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe netsh.exe PID 4080 wrote to memory of 2828 4080 wvojcrlv.exe svchost.exe PID 4080 wrote to memory of 2828 4080 wvojcrlv.exe svchost.exe PID 4080 wrote to memory of 2828 4080 wvojcrlv.exe svchost.exe PID 4080 wrote to memory of 2828 4080 wvojcrlv.exe svchost.exe PID 4080 wrote to memory of 2828 4080 wvojcrlv.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe"C:\Users\Admin\AppData\Local\Temp\45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xbuygxuk\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wvojcrlv.exe" C:\Windows\SysWOW64\xbuygxuk\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create xbuygxuk binPath= "C:\Windows\SysWOW64\xbuygxuk\wvojcrlv.exe /d\"C:\Users\Admin\AppData\Local\Temp\45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description xbuygxuk "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start xbuygxuk2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\SysWOW64\xbuygxuk\wvojcrlv.exeC:\Windows\SysWOW64\xbuygxuk\wvojcrlv.exe /d"C:\Users\Admin\AppData\Local\Temp\45e247392ea8d6187fd469161a3cb3ec2c465deacdf624f9cfafda37d070f26e.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\wvojcrlv.exeMD5
fca2ad651b067af02bb368e569006230
SHA12f57d388906802dbcdf49abc865e213877d1c17a
SHA256976ba4208d9d240e9634f68d553cba7ff88676c3940ec7cfa67bfc52b0251f67
SHA512bcdee22b9b546253797ea31843e3847cf7f2201c187cc049768404889984b8105e1f06357f88a88aa7836208efb53e75bbf34a6e752a1903d078097e309f5db5
-
C:\Windows\SysWOW64\xbuygxuk\wvojcrlv.exeMD5
fca2ad651b067af02bb368e569006230
SHA12f57d388906802dbcdf49abc865e213877d1c17a
SHA256976ba4208d9d240e9634f68d553cba7ff88676c3940ec7cfa67bfc52b0251f67
SHA512bcdee22b9b546253797ea31843e3847cf7f2201c187cc049768404889984b8105e1f06357f88a88aa7836208efb53e75bbf34a6e752a1903d078097e309f5db5
-
memory/2224-115-0x0000000000030000-0x000000000003D000-memory.dmpFilesize
52KB
-
memory/2224-116-0x0000000000450000-0x00000000004FE000-memory.dmpFilesize
696KB
-
memory/2224-117-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/2828-120-0x0000000000330000-0x0000000000345000-memory.dmpFilesize
84KB
-
memory/4080-124-0x0000000000490000-0x00000000004A3000-memory.dmpFilesize
76KB
-
memory/4080-125-0x0000000000400000-0x000000000044B000-memory.dmpFilesize
300KB
-
memory/4080-122-0x0000000000030000-0x000000000003D000-memory.dmpFilesize
52KB