Analysis
-
max time kernel
146s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-06-2022 14:58
Static task
static1
Behavioral task
behavioral1
Sample
1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe
Resource
win10v2004-20220414-en
General
-
Target
1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe
-
Size
138KB
-
MD5
e70dc7260416996a8b62ff3b6e0420f6
-
SHA1
3ad2783d4bc4ffd6d0a2dd4a61f16229b27839d0
-
SHA256
1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8
-
SHA512
260dfd93c94cf67c91345a1d8c6a5c2399633e25b53b8ad3d87b246235893a385728c86229f36ac257fe20d5dd979248af2c90b5b93f9dc402a0d59b6b71662e
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\tsnujszo = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
kovfftdz.exepid process 1712 kovfftdz.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tsnujszo\ImagePath = "C:\\Windows\\SysWOW64\\tsnujszo\\kovfftdz.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1440 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
kovfftdz.exedescription pid process target process PID 1712 set thread context of 1440 1712 kovfftdz.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2020 sc.exe 1452 sc.exe 1968 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exekovfftdz.exedescription pid process target process PID 732 wrote to memory of 2044 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe cmd.exe PID 732 wrote to memory of 2044 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe cmd.exe PID 732 wrote to memory of 2044 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe cmd.exe PID 732 wrote to memory of 2044 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe cmd.exe PID 732 wrote to memory of 2012 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe cmd.exe PID 732 wrote to memory of 2012 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe cmd.exe PID 732 wrote to memory of 2012 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe cmd.exe PID 732 wrote to memory of 2012 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe cmd.exe PID 732 wrote to memory of 2020 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 2020 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 2020 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 2020 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 1452 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 1452 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 1452 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 1452 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 1968 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 1968 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 1968 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 1968 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe sc.exe PID 732 wrote to memory of 1736 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe netsh.exe PID 732 wrote to memory of 1736 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe netsh.exe PID 732 wrote to memory of 1736 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe netsh.exe PID 732 wrote to memory of 1736 732 1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe netsh.exe PID 1712 wrote to memory of 1440 1712 kovfftdz.exe svchost.exe PID 1712 wrote to memory of 1440 1712 kovfftdz.exe svchost.exe PID 1712 wrote to memory of 1440 1712 kovfftdz.exe svchost.exe PID 1712 wrote to memory of 1440 1712 kovfftdz.exe svchost.exe PID 1712 wrote to memory of 1440 1712 kovfftdz.exe svchost.exe PID 1712 wrote to memory of 1440 1712 kovfftdz.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe"C:\Users\Admin\AppData\Local\Temp\1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tsnujszo\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kovfftdz.exe" C:\Windows\SysWOW64\tsnujszo\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create tsnujszo binPath= "C:\Windows\SysWOW64\tsnujszo\kovfftdz.exe /d\"C:\Users\Admin\AppData\Local\Temp\1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description tsnujszo "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start tsnujszo2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\tsnujszo\kovfftdz.exeC:\Windows\SysWOW64\tsnujszo\kovfftdz.exe /d"C:\Users\Admin\AppData\Local\Temp\1c8743843e7dcdc405dcfdc5745a05d66f8807740d0d7e3cd169172b9559c0d8.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\kovfftdz.exeFilesize
13.4MB
MD51b890496b674564443855f9ea270ad5c
SHA1e8e7a05e73f0a6eaae82c99a529b7c1ac726f06b
SHA256dcee4127e5254c5e40c07fca7653a56f7f0c37813deb8c48d494ce6284515339
SHA512ba39f6da6065ee3b230f044f136345f6af785dec4a12b464a286cc0e88da9ccc72f9cfe785f39face781bcbea6eae3661303d1814844439fb8f97e27018b8e6e
-
C:\Windows\SysWOW64\tsnujszo\kovfftdz.exeFilesize
13.4MB
MD51b890496b674564443855f9ea270ad5c
SHA1e8e7a05e73f0a6eaae82c99a529b7c1ac726f06b
SHA256dcee4127e5254c5e40c07fca7653a56f7f0c37813deb8c48d494ce6284515339
SHA512ba39f6da6065ee3b230f044f136345f6af785dec4a12b464a286cc0e88da9ccc72f9cfe785f39face781bcbea6eae3661303d1814844439fb8f97e27018b8e6e
-
memory/732-55-0x0000000076561000-0x0000000076563000-memory.dmpFilesize
8KB
-
memory/732-54-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1440-70-0x0000000000089A6B-mapping.dmp
-
memory/1440-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1440-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1440-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1440-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1452-60-0x0000000000000000-mapping.dmp
-
memory/1712-65-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1736-63-0x0000000000000000-mapping.dmp
-
memory/1968-61-0x0000000000000000-mapping.dmp
-
memory/2012-57-0x0000000000000000-mapping.dmp
-
memory/2020-59-0x0000000000000000-mapping.dmp
-
memory/2044-56-0x0000000000000000-mapping.dmp