Analysis
-
max time kernel
1795s -
max time network
1804s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-06-2022 15:33
Static task
static1
Behavioral task
behavioral1
Sample
6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe
Resource
win10v2004-20220414-en
General
-
Target
6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe
-
Size
13.9MB
-
MD5
3aaa4aecbe1e2646394602569e6cac7d
-
SHA1
191a54ac2bc0b727669fd08bb804fc7fd17601d5
-
SHA256
6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525
-
SHA512
7a36b8a7c2fd9189a3987e0ad1d109d3e81072546784d99719104f2359042285aaa2f9f0b4173effd6713b291813d9f08ae8804a87fb89bb0baea3b1fb20e86a
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\vqhkfxk = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
oiizktkm.exepid process 680 oiizktkm.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\vqhkfxk\ImagePath = "C:\\Windows\\SysWOW64\\vqhkfxk\\oiizktkm.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 928 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
oiizktkm.exedescription pid process target process PID 680 set thread context of 928 680 oiizktkm.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1288 sc.exe 964 sc.exe 664 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exeoiizktkm.exedescription pid process target process PID 800 wrote to memory of 1972 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe cmd.exe PID 800 wrote to memory of 1972 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe cmd.exe PID 800 wrote to memory of 1972 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe cmd.exe PID 800 wrote to memory of 1972 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe cmd.exe PID 800 wrote to memory of 1796 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe cmd.exe PID 800 wrote to memory of 1796 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe cmd.exe PID 800 wrote to memory of 1796 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe cmd.exe PID 800 wrote to memory of 1796 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe cmd.exe PID 800 wrote to memory of 1288 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 1288 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 1288 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 1288 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 964 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 964 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 964 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 964 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 664 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 664 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 664 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 664 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe sc.exe PID 800 wrote to memory of 584 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe netsh.exe PID 800 wrote to memory of 584 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe netsh.exe PID 800 wrote to memory of 584 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe netsh.exe PID 800 wrote to memory of 584 800 6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe netsh.exe PID 680 wrote to memory of 928 680 oiizktkm.exe svchost.exe PID 680 wrote to memory of 928 680 oiizktkm.exe svchost.exe PID 680 wrote to memory of 928 680 oiizktkm.exe svchost.exe PID 680 wrote to memory of 928 680 oiizktkm.exe svchost.exe PID 680 wrote to memory of 928 680 oiizktkm.exe svchost.exe PID 680 wrote to memory of 928 680 oiizktkm.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe"C:\Users\Admin\AppData\Local\Temp\6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vqhkfxk\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\oiizktkm.exe" C:\Windows\SysWOW64\vqhkfxk\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create vqhkfxk binPath= "C:\Windows\SysWOW64\vqhkfxk\oiizktkm.exe /d\"C:\Users\Admin\AppData\Local\Temp\6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description vqhkfxk "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start vqhkfxk2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\vqhkfxk\oiizktkm.exeC:\Windows\SysWOW64\vqhkfxk\oiizktkm.exe /d"C:\Users\Admin\AppData\Local\Temp\6ec7645e2cbbaf7d7d6c836cacf353c072bab4e785992c90b172f26263d55525.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\oiizktkm.exeFilesize
14.7MB
MD5bde9e61449b78098dfd0d351d361b5e3
SHA16a38d0dec4d48fe791b1f7a8393837e68ebb5dfb
SHA2565510628aa83f28a2d43fb02b78e4c3b5d430d8a845fc9205d911231441979530
SHA5121dbf25157e907e0885238d0539d84732116ba02740ccd2d34a90e7e9c8c1812b8ea02475eb1a67f6bd255515414372f11344845b8a3b5ecee25c9d9303c6c4d7
-
C:\Windows\SysWOW64\vqhkfxk\oiizktkm.exeFilesize
14.7MB
MD5bde9e61449b78098dfd0d351d361b5e3
SHA16a38d0dec4d48fe791b1f7a8393837e68ebb5dfb
SHA2565510628aa83f28a2d43fb02b78e4c3b5d430d8a845fc9205d911231441979530
SHA5121dbf25157e907e0885238d0539d84732116ba02740ccd2d34a90e7e9c8c1812b8ea02475eb1a67f6bd255515414372f11344845b8a3b5ecee25c9d9303c6c4d7
-
memory/584-65-0x0000000000000000-mapping.dmp
-
memory/664-63-0x0000000000000000-mapping.dmp
-
memory/680-74-0x000000000059D000-0x00000000005AB000-memory.dmpFilesize
56KB
-
memory/680-77-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB
-
memory/800-66-0x00000000002ED000-0x00000000002FB000-memory.dmpFilesize
56KB
-
memory/800-56-0x00000000002ED000-0x00000000002FB000-memory.dmpFilesize
56KB
-
memory/800-57-0x00000000001B0000-0x00000000001C3000-memory.dmpFilesize
76KB
-
memory/800-58-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB
-
memory/800-54-0x00000000765F1000-0x00000000765F3000-memory.dmpFilesize
8KB
-
memory/800-67-0x0000000000400000-0x00000000004E7000-memory.dmpFilesize
924KB
-
memory/928-72-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/928-70-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/928-73-0x00000000000C9A6B-mapping.dmp
-
memory/928-79-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/928-80-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/964-62-0x0000000000000000-mapping.dmp
-
memory/1288-61-0x0000000000000000-mapping.dmp
-
memory/1796-59-0x0000000000000000-mapping.dmp
-
memory/1972-55-0x0000000000000000-mapping.dmp