Analysis
-
max time kernel
145s -
max time network
136s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
05-06-2022 09:25
Static task
static1
Behavioral task
behavioral1
Sample
cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe
Resource
win10-20220414-en
General
-
Target
cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe
-
Size
309KB
-
MD5
7d40376fee22fcd7c818a9fec569ba68
-
SHA1
97e9ab6393116df99769e48595501b54fb01f65f
-
SHA256
cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e
-
SHA512
2eaa34fbbfa4d03f6e7c1bf31f79880cea0ef00af17f13007aaf5d53cd15ed4632a4807408384a6392acb18e995eab6e77bb60413faee8814da5f9c6c0503e22
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\hxcpeydy = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
cmsyrbop.exepid process 4836 cmsyrbop.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hxcpeydy\ImagePath = "C:\\Windows\\SysWOW64\\hxcpeydy\\cmsyrbop.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 4048 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cmsyrbop.exedescription pid process target process PID 4836 set thread context of 4048 4836 cmsyrbop.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1644 sc.exe 4368 sc.exe 4916 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Control Panel\Buses svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 008d093f41be820624edb47d450dd49d084297dce82e72baa46d34fdc48d541d1b5628df81cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda56816d585447334e0a4644490bdb57a2def905e0dcbfdbd54758df21d5904fca76e14df8c4f703fed9d084295d9e13f4bb4c06d05c9c4e4241dd594450b3cfca76414d9b40e367b8be90d4091bda97520e892540ccff6bd54718bce15515bb9fd3041ed85487635e5a45314c18a84 svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.execmsyrbop.exedescription pid process target process PID 2956 wrote to memory of 4880 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe cmd.exe PID 2956 wrote to memory of 4880 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe cmd.exe PID 2956 wrote to memory of 4880 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe cmd.exe PID 2956 wrote to memory of 4004 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe cmd.exe PID 2956 wrote to memory of 4004 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe cmd.exe PID 2956 wrote to memory of 4004 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe cmd.exe PID 2956 wrote to memory of 1644 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe sc.exe PID 2956 wrote to memory of 1644 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe sc.exe PID 2956 wrote to memory of 1644 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe sc.exe PID 2956 wrote to memory of 4368 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe sc.exe PID 2956 wrote to memory of 4368 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe sc.exe PID 2956 wrote to memory of 4368 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe sc.exe PID 2956 wrote to memory of 4916 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe sc.exe PID 2956 wrote to memory of 4916 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe sc.exe PID 2956 wrote to memory of 4916 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe sc.exe PID 2956 wrote to memory of 2352 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe netsh.exe PID 2956 wrote to memory of 2352 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe netsh.exe PID 2956 wrote to memory of 2352 2956 cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe netsh.exe PID 4836 wrote to memory of 4048 4836 cmsyrbop.exe svchost.exe PID 4836 wrote to memory of 4048 4836 cmsyrbop.exe svchost.exe PID 4836 wrote to memory of 4048 4836 cmsyrbop.exe svchost.exe PID 4836 wrote to memory of 4048 4836 cmsyrbop.exe svchost.exe PID 4836 wrote to memory of 4048 4836 cmsyrbop.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe"C:\Users\Admin\AppData\Local\Temp\cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hxcpeydy\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cmsyrbop.exe" C:\Windows\SysWOW64\hxcpeydy\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create hxcpeydy binPath= "C:\Windows\SysWOW64\hxcpeydy\cmsyrbop.exe /d\"C:\Users\Admin\AppData\Local\Temp\cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description hxcpeydy "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start hxcpeydy2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\hxcpeydy\cmsyrbop.exeC:\Windows\SysWOW64\hxcpeydy\cmsyrbop.exe /d"C:\Users\Admin\AppData\Local\Temp\cf822f50e274b82120b3389049e8931948bc535a4b95c905efa9416225668c2e.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
- Drops file in System32 directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cmsyrbop.exeFilesize
13.9MB
MD593f39e951955ad8eab06791519bf8014
SHA1d6ed1d82fa038e08ef410abc930bf507acd014f2
SHA2566a2d3b64f188e8a91585dafa76d9f2511d7b357398c43186eb613cd330310c6d
SHA512c2f0e40aa692711ed3ffa957ec0aa88ce0b1765f0bcaaaa471db7d5d5ff3451feb7b807efd096ce92993c3a94b260f52abdb89ab902cd643c299bf6132354019
-
C:\Windows\SysWOW64\hxcpeydy\cmsyrbop.exeFilesize
13.9MB
MD593f39e951955ad8eab06791519bf8014
SHA1d6ed1d82fa038e08ef410abc930bf507acd014f2
SHA2566a2d3b64f188e8a91585dafa76d9f2511d7b357398c43186eb613cd330310c6d
SHA512c2f0e40aa692711ed3ffa957ec0aa88ce0b1765f0bcaaaa471db7d5d5ff3451feb7b807efd096ce92993c3a94b260f52abdb89ab902cd643c299bf6132354019
-
memory/1644-184-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1644-185-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1644-187-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1644-186-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1644-183-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1644-182-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/1644-180-0x0000000000000000-mapping.dmp
-
memory/1644-181-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2352-221-0x0000000000000000-mapping.dmp
-
memory/2956-138-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-165-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-130-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-131-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-132-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-133-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-134-0x00000000008A1000-0x00000000008B1000-memory.dmpFilesize
64KB
-
memory/2956-136-0x0000000000830000-0x0000000000843000-memory.dmpFilesize
76KB
-
memory/2956-135-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-137-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-117-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-139-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-140-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-141-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-142-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-143-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-144-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-145-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-146-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-148-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-149-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-150-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-147-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-152-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-153-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-154-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-151-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-155-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-157-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-156-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-158-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-159-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-160-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2956-161-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-162-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-163-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-164-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-129-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-166-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-227-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/2956-225-0x0000000000830000-0x0000000000843000-memory.dmpFilesize
76KB
-
memory/2956-118-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-223-0x00000000008A1000-0x00000000008B1000-memory.dmpFilesize
64KB
-
memory/2956-119-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-120-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-121-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-122-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-123-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-124-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-125-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-126-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-128-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2956-127-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4004-178-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4004-176-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4004-177-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4004-173-0x0000000000000000-mapping.dmp
-
memory/4004-174-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4004-175-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4048-486-0x00000000027C0000-0x00000000027D5000-memory.dmpFilesize
84KB
-
memory/4048-393-0x00000000027C0000-0x00000000027D5000-memory.dmpFilesize
84KB
-
memory/4048-300-0x00000000027C9A6B-mapping.dmp
-
memory/4368-191-0x0000000000000000-mapping.dmp
-
memory/4836-270-0x0000000000500000-0x000000000064A000-memory.dmpFilesize
1.3MB
-
memory/4836-267-0x000000000083C000-0x000000000084C000-memory.dmpFilesize
64KB
-
memory/4836-308-0x000000000083C000-0x000000000084C000-memory.dmpFilesize
64KB
-
memory/4836-311-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/4880-169-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4880-168-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4880-167-0x0000000000000000-mapping.dmp
-
memory/4880-170-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4880-171-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4880-172-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/4916-202-0x0000000000000000-mapping.dmp