Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-06-2022 13:39
Static task
static1
Behavioral task
behavioral1
Sample
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe
Resource
win10v2004-20220414-en
General
-
Target
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe
-
Size
316KB
-
MD5
5c3ecbbd07a3a9ea27ab0bddb1a6176d
-
SHA1
171a1e5ad3fb212af8e30d73a70338c319b4f346
-
SHA256
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37
-
SHA512
0a09c1313c03249c72f19ffe84cb5c3758b9f1394f82aaac24f969009e21b5647cf9af3b3f35703a27c8496427692a8c715c72ac3bd9f918f7cb6ccf21dc8465
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
sqxtsbzq.exepid process 4044 sqxtsbzq.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wbjcphuq\ImagePath = "C:\\Windows\\SysWOW64\\wbjcphuq\\sqxtsbzq.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
sqxtsbzq.exedescription pid process target process PID 4044 set thread context of 1472 4044 sqxtsbzq.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 4380 sc.exe 4292 sc.exe 4252 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exesqxtsbzq.exedescription pid process target process PID 3316 wrote to memory of 4628 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 3316 wrote to memory of 4628 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 3316 wrote to memory of 4628 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 3316 wrote to memory of 1324 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 3316 wrote to memory of 1324 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 3316 wrote to memory of 1324 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe cmd.exe PID 3316 wrote to memory of 4380 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 3316 wrote to memory of 4380 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 3316 wrote to memory of 4380 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 3316 wrote to memory of 4292 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 3316 wrote to memory of 4292 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 3316 wrote to memory of 4292 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 3316 wrote to memory of 4252 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 3316 wrote to memory of 4252 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 3316 wrote to memory of 4252 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe sc.exe PID 3316 wrote to memory of 4860 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe netsh.exe PID 3316 wrote to memory of 4860 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe netsh.exe PID 3316 wrote to memory of 4860 3316 100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe netsh.exe PID 4044 wrote to memory of 1472 4044 sqxtsbzq.exe svchost.exe PID 4044 wrote to memory of 1472 4044 sqxtsbzq.exe svchost.exe PID 4044 wrote to memory of 1472 4044 sqxtsbzq.exe svchost.exe PID 4044 wrote to memory of 1472 4044 sqxtsbzq.exe svchost.exe PID 4044 wrote to memory of 1472 4044 sqxtsbzq.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe"C:\Users\Admin\AppData\Local\Temp\100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\wbjcphuq\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\sqxtsbzq.exe" C:\Windows\SysWOW64\wbjcphuq\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create wbjcphuq binPath= "C:\Windows\SysWOW64\wbjcphuq\sqxtsbzq.exe /d\"C:\Users\Admin\AppData\Local\Temp\100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description wbjcphuq "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start wbjcphuq2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\wbjcphuq\sqxtsbzq.exeC:\Windows\SysWOW64\wbjcphuq\sqxtsbzq.exe /d"C:\Users\Admin\AppData\Local\Temp\100d8852de93e54659c2e9da519cab6934f488bf4c959889f978e49c8ba59e37.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sqxtsbzq.exeFilesize
13.4MB
MD54552ddbc02e787b87936feb977b62449
SHA1665d10cd1cd2c8492bf16505c4358f115018cde3
SHA2560ceecda1da989499df99c5c72c41fc89e9cd7abab9b698fb865d73b72d263c8a
SHA51203566d60591f5d6684ded5c12fed44c0614d58bd26742c4349af54c5eaed03c5db824e7a23ffb58df2da14dabe23871635b5410155c7fbc974b35f78d7ed6897
-
C:\Windows\SysWOW64\wbjcphuq\sqxtsbzq.exeFilesize
13.4MB
MD54552ddbc02e787b87936feb977b62449
SHA1665d10cd1cd2c8492bf16505c4358f115018cde3
SHA2560ceecda1da989499df99c5c72c41fc89e9cd7abab9b698fb865d73b72d263c8a
SHA51203566d60591f5d6684ded5c12fed44c0614d58bd26742c4349af54c5eaed03c5db824e7a23ffb58df2da14dabe23871635b5410155c7fbc974b35f78d7ed6897
-
memory/1324-133-0x0000000000000000-mapping.dmp
-
memory/1472-150-0x0000000001030000-0x0000000001045000-memory.dmpFilesize
84KB
-
memory/1472-149-0x0000000001030000-0x0000000001045000-memory.dmpFilesize
84KB
-
memory/1472-144-0x0000000001030000-0x0000000001045000-memory.dmpFilesize
84KB
-
memory/1472-143-0x0000000000000000-mapping.dmp
-
memory/3316-131-0x00000000054B0000-0x00000000054BF000-memory.dmpFilesize
60KB
-
memory/3316-134-0x0000000000400000-0x00000000052AF000-memory.dmpFilesize
78.7MB
-
memory/3316-130-0x00000000054B0000-0x00000000054BF000-memory.dmpFilesize
60KB
-
memory/3316-140-0x0000000000400000-0x00000000052AF000-memory.dmpFilesize
78.7MB
-
memory/4044-142-0x00000000055EC000-0x00000000055FB000-memory.dmpFilesize
60KB
-
memory/4044-146-0x00000000055EC000-0x00000000055FB000-memory.dmpFilesize
60KB
-
memory/4044-148-0x0000000000400000-0x00000000052AF000-memory.dmpFilesize
78.7MB
-
memory/4252-138-0x0000000000000000-mapping.dmp
-
memory/4292-137-0x0000000000000000-mapping.dmp
-
memory/4380-136-0x0000000000000000-mapping.dmp
-
memory/4628-132-0x0000000000000000-mapping.dmp
-
memory/4860-139-0x0000000000000000-mapping.dmp