Analysis
-
max time kernel
1801s -
max time network
1797s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-06-2022 01:56
Static task
static1
Behavioral task
behavioral1
Sample
5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe
Resource
win10v2004-20220414-en
General
-
Target
5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe
-
Size
10.5MB
-
MD5
222c77202aaadbae9167f125d5235c93
-
SHA1
bdaa4533ebd52e7c4936cc2612ae9cc850ccdd6c
-
SHA256
5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946
-
SHA512
834691c22d611de565c4b147728f74d7cc24b623c5bdda53f43e6fc129cce765a43cfb31982618e5fb341e676adf2eb816192b1fcb26a1cd00399429db46bbbe
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ewhrtnk = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
zvnnkzym.exepid process 1892 zvnnkzym.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ewhrtnk\ImagePath = "C:\\Windows\\SysWOW64\\ewhrtnk\\zvnnkzym.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1836 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zvnnkzym.exedescription pid process target process PID 1892 set thread context of 1836 1892 zvnnkzym.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1748 sc.exe 1908 sc.exe 784 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exezvnnkzym.exedescription pid process target process PID 2024 wrote to memory of 1064 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe cmd.exe PID 2024 wrote to memory of 1064 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe cmd.exe PID 2024 wrote to memory of 1064 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe cmd.exe PID 2024 wrote to memory of 1064 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe cmd.exe PID 2024 wrote to memory of 1456 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe cmd.exe PID 2024 wrote to memory of 1456 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe cmd.exe PID 2024 wrote to memory of 1456 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe cmd.exe PID 2024 wrote to memory of 1456 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe cmd.exe PID 2024 wrote to memory of 1748 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 1748 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 1748 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 1748 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 1908 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 1908 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 1908 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 1908 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 784 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 784 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 784 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 784 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe sc.exe PID 2024 wrote to memory of 1812 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe netsh.exe PID 2024 wrote to memory of 1812 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe netsh.exe PID 2024 wrote to memory of 1812 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe netsh.exe PID 2024 wrote to memory of 1812 2024 5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe netsh.exe PID 1892 wrote to memory of 1836 1892 zvnnkzym.exe svchost.exe PID 1892 wrote to memory of 1836 1892 zvnnkzym.exe svchost.exe PID 1892 wrote to memory of 1836 1892 zvnnkzym.exe svchost.exe PID 1892 wrote to memory of 1836 1892 zvnnkzym.exe svchost.exe PID 1892 wrote to memory of 1836 1892 zvnnkzym.exe svchost.exe PID 1892 wrote to memory of 1836 1892 zvnnkzym.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe"C:\Users\Admin\AppData\Local\Temp\5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ewhrtnk\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zvnnkzym.exe" C:\Windows\SysWOW64\ewhrtnk\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ewhrtnk binPath= "C:\Windows\SysWOW64\ewhrtnk\zvnnkzym.exe /d\"C:\Users\Admin\AppData\Local\Temp\5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ewhrtnk "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ewhrtnk2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\ewhrtnk\zvnnkzym.exeC:\Windows\SysWOW64\ewhrtnk\zvnnkzym.exe /d"C:\Users\Admin\AppData\Local\Temp\5c9432e3f389b63a63d2aa8eed0e91350b86370539542f5a9f572395eabef946.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\zvnnkzym.exeFilesize
13.8MB
MD557154b1f9a253b3306e78eb3d0dd2695
SHA1f764b883fff21b19a48fee9fc86a2f09b707f4c5
SHA256548dcb4695d3e68d2155e8c94d3b516a24f1dfd7b12f02c875bb921ca691bbbb
SHA512d59e68579a7a96f2d09b4ec7017a8d8576202f475ed3cb8d0193822016786392f7bedd5f62b5827efd85a2ec7c53bc47aa73e0daee89c6a3872174b2d7b2d1e4
-
C:\Windows\SysWOW64\ewhrtnk\zvnnkzym.exeFilesize
13.8MB
MD557154b1f9a253b3306e78eb3d0dd2695
SHA1f764b883fff21b19a48fee9fc86a2f09b707f4c5
SHA256548dcb4695d3e68d2155e8c94d3b516a24f1dfd7b12f02c875bb921ca691bbbb
SHA512d59e68579a7a96f2d09b4ec7017a8d8576202f475ed3cb8d0193822016786392f7bedd5f62b5827efd85a2ec7c53bc47aa73e0daee89c6a3872174b2d7b2d1e4
-
memory/784-63-0x0000000000000000-mapping.dmp
-
memory/1064-57-0x0000000000000000-mapping.dmp
-
memory/1456-59-0x0000000000000000-mapping.dmp
-
memory/1748-61-0x0000000000000000-mapping.dmp
-
memory/1812-65-0x0000000000000000-mapping.dmp
-
memory/1836-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1836-80-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1836-79-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1836-72-0x0000000000089A6B-mapping.dmp
-
memory/1836-71-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1892-77-0x0000000000400000-0x0000000002321000-memory.dmpFilesize
31.1MB
-
memory/1892-74-0x00000000023D9000-0x00000000023E7000-memory.dmpFilesize
56KB
-
memory/1908-62-0x0000000000000000-mapping.dmp
-
memory/2024-55-0x0000000002469000-0x0000000002477000-memory.dmpFilesize
56KB
-
memory/2024-67-0x0000000000400000-0x0000000002321000-memory.dmpFilesize
31.1MB
-
memory/2024-66-0x0000000002469000-0x0000000002477000-memory.dmpFilesize
56KB
-
memory/2024-56-0x0000000000230000-0x0000000000243000-memory.dmpFilesize
76KB
-
memory/2024-54-0x0000000074DD1000-0x0000000074DD3000-memory.dmpFilesize
8KB
-
memory/2024-58-0x0000000000400000-0x0000000002321000-memory.dmpFilesize
31.1MB