Analysis
-
max time kernel
148s -
max time network
185s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-06-2022 13:33
Static task
static1
Behavioral task
behavioral1
Sample
101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe
Resource
win10v2004-20220414-en
General
-
Target
101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe
-
Size
137KB
-
MD5
d621a78cf6343c38fa7356b7a2846ddd
-
SHA1
8037750152302eeffddab9e0efe93967bbafd582
-
SHA256
101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7
-
SHA512
6c3144dc20bc6048456bb6330b93df1566d969971334259e393c15e38c1f282e24f982ea28400b53283a6b538d4a7fcbe6283cad0fe24b8f45cd26bdc4c70ef4
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
ggmiwwcu.exepid process 456 ggmiwwcu.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\gvtrvedb\ImagePath = "C:\\Windows\\SysWOW64\\gvtrvedb\\ggmiwwcu.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1964 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ggmiwwcu.exedescription pid process target process PID 456 set thread context of 1964 456 ggmiwwcu.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1636 sc.exe 1296 sc.exe 588 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exeggmiwwcu.exedescription pid process target process PID 1688 wrote to memory of 272 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe cmd.exe PID 1688 wrote to memory of 272 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe cmd.exe PID 1688 wrote to memory of 272 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe cmd.exe PID 1688 wrote to memory of 272 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe cmd.exe PID 1688 wrote to memory of 104 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe cmd.exe PID 1688 wrote to memory of 104 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe cmd.exe PID 1688 wrote to memory of 104 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe cmd.exe PID 1688 wrote to memory of 104 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe cmd.exe PID 1688 wrote to memory of 1636 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 1636 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 1636 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 1636 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 1296 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 1296 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 1296 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 1296 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 588 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 588 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 588 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 588 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe sc.exe PID 1688 wrote to memory of 1204 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe netsh.exe PID 1688 wrote to memory of 1204 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe netsh.exe PID 1688 wrote to memory of 1204 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe netsh.exe PID 1688 wrote to memory of 1204 1688 101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe netsh.exe PID 456 wrote to memory of 1964 456 ggmiwwcu.exe svchost.exe PID 456 wrote to memory of 1964 456 ggmiwwcu.exe svchost.exe PID 456 wrote to memory of 1964 456 ggmiwwcu.exe svchost.exe PID 456 wrote to memory of 1964 456 ggmiwwcu.exe svchost.exe PID 456 wrote to memory of 1964 456 ggmiwwcu.exe svchost.exe PID 456 wrote to memory of 1964 456 ggmiwwcu.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe"C:\Users\Admin\AppData\Local\Temp\101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gvtrvedb\2⤵PID:272
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ggmiwwcu.exe" C:\Windows\SysWOW64\gvtrvedb\2⤵PID:104
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create gvtrvedb binPath= "C:\Windows\SysWOW64\gvtrvedb\ggmiwwcu.exe /d\"C:\Users\Admin\AppData\Local\Temp\101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:1636 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description gvtrvedb "wifi internet conection"2⤵
- Launches sc.exe
PID:1296 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start gvtrvedb2⤵
- Launches sc.exe
PID:588 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:1204
-
C:\Windows\SysWOW64\gvtrvedb\ggmiwwcu.exeC:\Windows\SysWOW64\gvtrvedb\ggmiwwcu.exe /d"C:\Users\Admin\AppData\Local\Temp\101512df3ce4c79c8f763e779e8d0cf1bfe31089b7107eb384280c3f6adc40b7.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:1964
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ggmiwwcu.exeFilesize
13.5MB
MD5a6c72af2a647c26ec370b366dcc6c5a5
SHA1f2938056f23209d4fd4755d9982fa619b9e815ab
SHA256ad1878463b85ece6a53f57dec28965bcd7accd875d40c200e11513830a008a67
SHA5121a6fbe53c18bfbef7094543aec57d9dd1be147224539c69906e3539653a53d628a47a2d73f7f96804b46c190516a5691dfc57c7b4c5e7da8c7236604712f6af8
-
C:\Windows\SysWOW64\gvtrvedb\ggmiwwcu.exeFilesize
13.5MB
MD5a6c72af2a647c26ec370b366dcc6c5a5
SHA1f2938056f23209d4fd4755d9982fa619b9e815ab
SHA256ad1878463b85ece6a53f57dec28965bcd7accd875d40c200e11513830a008a67
SHA5121a6fbe53c18bfbef7094543aec57d9dd1be147224539c69906e3539653a53d628a47a2d73f7f96804b46c190516a5691dfc57c7b4c5e7da8c7236604712f6af8
-
memory/104-57-0x0000000000000000-mapping.dmp
-
memory/272-56-0x0000000000000000-mapping.dmp
-
memory/456-65-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/588-61-0x0000000000000000-mapping.dmp
-
memory/1204-63-0x0000000000000000-mapping.dmp
-
memory/1296-60-0x0000000000000000-mapping.dmp
-
memory/1636-59-0x0000000000000000-mapping.dmp
-
memory/1688-54-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1688-55-0x00000000751C1000-0x00000000751C3000-memory.dmpFilesize
8KB
-
memory/1964-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1964-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1964-70-0x0000000000089A6B-mapping.dmp
-
memory/1964-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1964-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB