Analysis
-
max time kernel
143s -
max time network
170s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-06-2022 16:09
Static task
static1
Behavioral task
behavioral1
Sample
0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe
Resource
win10v2004-20220414-en
General
-
Target
0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe
-
Size
98KB
-
MD5
b34b1258a1e5b89d9fbdd9aac4c47bec
-
SHA1
8f1550ed6e666752230cf637c71743512a6dda45
-
SHA256
0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8
-
SHA512
1bb74f49b3e37f60afc80c607460e451e143856a0a7212ef3136dc34ecb3969e27370b7fc5266ff73fd8eab62b5155d96a8288fb247f6104a1a911130dc306d5
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\iqjugkhw = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
qviilkaf.exepid process 1704 qviilkaf.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\iqjugkhw\ImagePath = "C:\\Windows\\SysWOW64\\iqjugkhw\\qviilkaf.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 824 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
qviilkaf.exedescription pid process target process PID 1704 set thread context of 824 1704 qviilkaf.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2032 sc.exe 588 sc.exe 1708 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exeqviilkaf.exedescription pid process target process PID 1528 wrote to memory of 1164 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe cmd.exe PID 1528 wrote to memory of 1164 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe cmd.exe PID 1528 wrote to memory of 1164 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe cmd.exe PID 1528 wrote to memory of 1164 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe cmd.exe PID 1528 wrote to memory of 1308 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe cmd.exe PID 1528 wrote to memory of 1308 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe cmd.exe PID 1528 wrote to memory of 1308 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe cmd.exe PID 1528 wrote to memory of 1308 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe cmd.exe PID 1528 wrote to memory of 2032 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 2032 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 2032 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 2032 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 588 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 588 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 588 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 588 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 1708 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 1708 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 1708 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 1708 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe sc.exe PID 1528 wrote to memory of 772 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe netsh.exe PID 1528 wrote to memory of 772 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe netsh.exe PID 1528 wrote to memory of 772 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe netsh.exe PID 1528 wrote to memory of 772 1528 0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe netsh.exe PID 1704 wrote to memory of 824 1704 qviilkaf.exe svchost.exe PID 1704 wrote to memory of 824 1704 qviilkaf.exe svchost.exe PID 1704 wrote to memory of 824 1704 qviilkaf.exe svchost.exe PID 1704 wrote to memory of 824 1704 qviilkaf.exe svchost.exe PID 1704 wrote to memory of 824 1704 qviilkaf.exe svchost.exe PID 1704 wrote to memory of 824 1704 qviilkaf.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe"C:\Users\Admin\AppData\Local\Temp\0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\iqjugkhw\2⤵PID:1164
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qviilkaf.exe" C:\Windows\SysWOW64\iqjugkhw\2⤵PID:1308
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create iqjugkhw binPath= "C:\Windows\SysWOW64\iqjugkhw\qviilkaf.exe /d\"C:\Users\Admin\AppData\Local\Temp\0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2032 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description iqjugkhw "wifi internet conection"2⤵
- Launches sc.exe
PID:588 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start iqjugkhw2⤵
- Launches sc.exe
PID:1708 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:772
-
C:\Windows\SysWOW64\iqjugkhw\qviilkaf.exeC:\Windows\SysWOW64\iqjugkhw\qviilkaf.exe /d"C:\Users\Admin\AppData\Local\Temp\0f46fce8d6203de3ea82a70f7abddfbf95850f7b1356ac967e05d955aa1566d8.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:824
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qviilkaf.exeFilesize
11.4MB
MD5c07ba6bed86120c640639b8d65d3aa08
SHA1a0da9f30d664095e5b817fa65ff206a02a4405ae
SHA25668d283939acf7ee6e5f022adbfbe744ab211cdd64f33b1991a7aaae5bfb82b22
SHA512d4c18de612065ef1ac6ab83dbd7da116d44daf0a31668fc5ee1afb93acb279ebb59070382805a204ecdc9b71ad5cfd61d33f91153bed9c52a0635ab20c4f372c
-
C:\Windows\SysWOW64\iqjugkhw\qviilkaf.exeFilesize
11.4MB
MD5c07ba6bed86120c640639b8d65d3aa08
SHA1a0da9f30d664095e5b817fa65ff206a02a4405ae
SHA25668d283939acf7ee6e5f022adbfbe744ab211cdd64f33b1991a7aaae5bfb82b22
SHA512d4c18de612065ef1ac6ab83dbd7da116d44daf0a31668fc5ee1afb93acb279ebb59070382805a204ecdc9b71ad5cfd61d33f91153bed9c52a0635ab20c4f372c
-
memory/588-60-0x0000000000000000-mapping.dmp
-
memory/772-62-0x0000000000000000-mapping.dmp
-
memory/824-66-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/824-68-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/824-69-0x0000000000089A6B-mapping.dmp
-
memory/824-73-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/824-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1164-56-0x0000000000000000-mapping.dmp
-
memory/1308-57-0x0000000000000000-mapping.dmp
-
memory/1528-54-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1528-55-0x00000000764C1000-0x00000000764C3000-memory.dmpFilesize
8KB
-
memory/1704-64-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1708-61-0x0000000000000000-mapping.dmp
-
memory/2032-59-0x0000000000000000-mapping.dmp