Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-06-2022 13:39
Static task
static1
Behavioral task
behavioral1
Sample
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe
Resource
win10v2004-20220414-en
General
-
Target
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe
-
Size
316KB
-
MD5
5c3ecbbd07a3a9ea27ab0bddb1a6176d
-
SHA1
171a1e5ad3fb212af8e30d73a70338c319b4f346
-
SHA256
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37
-
SHA512
0a09c1313c03249c72f19ffe84cb5c3758b9f1394f82aaac24f969009e21b5647cf9af3b3f35703a27c8496427692a8c715c72ac3bd9f918f7cb6ccf21dc8465
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\hhkdeaew = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
plflrtlc.exepid process 1668 plflrtlc.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\hhkdeaew\ImagePath = "C:\\Windows\\SysWOW64\\hhkdeaew\\plflrtlc.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1760 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
plflrtlc.exedescription pid process target process PID 1668 set thread context of 1760 1668 plflrtlc.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1176 sc.exe 1956 sc.exe 876 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exeplflrtlc.exedescription pid process target process PID 904 wrote to memory of 608 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 904 wrote to memory of 608 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 904 wrote to memory of 608 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 904 wrote to memory of 608 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 904 wrote to memory of 1208 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 904 wrote to memory of 1208 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 904 wrote to memory of 1208 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 904 wrote to memory of 1208 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 904 wrote to memory of 1176 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 1176 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 1176 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 1176 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 1956 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 1956 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 1956 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 1956 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 876 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 876 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 876 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 876 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 904 wrote to memory of 336 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe netsh.exe PID 904 wrote to memory of 336 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe netsh.exe PID 904 wrote to memory of 336 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe netsh.exe PID 904 wrote to memory of 336 904 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe netsh.exe PID 1668 wrote to memory of 1760 1668 plflrtlc.exe svchost.exe PID 1668 wrote to memory of 1760 1668 plflrtlc.exe svchost.exe PID 1668 wrote to memory of 1760 1668 plflrtlc.exe svchost.exe PID 1668 wrote to memory of 1760 1668 plflrtlc.exe svchost.exe PID 1668 wrote to memory of 1760 1668 plflrtlc.exe svchost.exe PID 1668 wrote to memory of 1760 1668 plflrtlc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe"C:\Users\Admin\AppData\Local\Temp\100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hhkdeaew\2⤵PID:608
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\plflrtlc.exe" C:\Windows\SysWOW64\hhkdeaew\2⤵PID:1208
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create hhkdeaew binPath= "C:\Windows\SysWOW64\hhkdeaew\plflrtlc.exe /d\"C:\Users\Admin\AppData\Local\Temp\100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:1176 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description hhkdeaew "wifi internet conection"2⤵
- Launches sc.exe
PID:1956 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start hhkdeaew2⤵
- Launches sc.exe
PID:876 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:336
-
C:\Windows\SysWOW64\hhkdeaew\plflrtlc.exeC:\Windows\SysWOW64\hhkdeaew\plflrtlc.exe /d"C:\Users\Admin\AppData\Local\Temp\100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:1760
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\plflrtlc.exeFilesize
10.1MB
MD52de28a5d2387c45511d0a9c49b057d43
SHA1b24631580fde4fbee0e4f83da5e93a0db776f9ea
SHA2567b4daa9b35240dcfbe8f21418308111c8f43a7c50a0a6de227ae724ff8a47d48
SHA512a9e0ddb68b67ed9a843d1280606c8efecbdef20d337b06a13b4f3e99c20d724e19ff461c1932d91de18399eed7a099e1396bcef62795f8325ddf01e36defc099
-
C:\Windows\SysWOW64\hhkdeaew\plflrtlc.exeFilesize
10.1MB
MD52de28a5d2387c45511d0a9c49b057d43
SHA1b24631580fde4fbee0e4f83da5e93a0db776f9ea
SHA2567b4daa9b35240dcfbe8f21418308111c8f43a7c50a0a6de227ae724ff8a47d48
SHA512a9e0ddb68b67ed9a843d1280606c8efecbdef20d337b06a13b4f3e99c20d724e19ff461c1932d91de18399eed7a099e1396bcef62795f8325ddf01e36defc099
-
memory/336-64-0x0000000000000000-mapping.dmp
-
memory/608-56-0x0000000000000000-mapping.dmp
-
memory/876-63-0x0000000000000000-mapping.dmp
-
memory/904-65-0x0000000000400000-0x00000000052AF000-memory.dmpFilesize
78.7MB
-
memory/904-55-0x00000000751C1000-0x00000000751C3000-memory.dmpFilesize
8KB
-
memory/904-57-0x00000000002A2000-0x00000000002B1000-memory.dmpFilesize
60KB
-
memory/904-58-0x0000000000400000-0x00000000052AF000-memory.dmpFilesize
78.7MB
-
memory/904-54-0x00000000002A2000-0x00000000002B1000-memory.dmpFilesize
60KB
-
memory/1176-61-0x0000000000000000-mapping.dmp
-
memory/1208-59-0x0000000000000000-mapping.dmp
-
memory/1668-68-0x0000000005401000-0x0000000005410000-memory.dmpFilesize
60KB
-
memory/1668-75-0x0000000005401000-0x0000000005410000-memory.dmpFilesize
60KB
-
memory/1668-78-0x0000000000400000-0x00000000052AF000-memory.dmpFilesize
78.7MB
-
memory/1760-70-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1760-72-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1760-73-0x0000000000089A6B-mapping.dmp
-
memory/1760-79-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1760-80-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1956-62-0x0000000000000000-mapping.dmp