Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-06-2022 15:04
Static task
static1
Behavioral task
behavioral1
Sample
1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe
Resource
win10v2004-20220414-en
General
-
Target
1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe
-
Size
102KB
-
MD5
b615ff689101509b760415b534294205
-
SHA1
5850c0b7a2783482c093aeed72ab212b0dabe6fe
-
SHA256
1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1
-
SHA512
1eb7f5b08d9fd19a26f1f75368dbd9e0af74c9bfeb361a8d5ad89c67c3b9562038d78e4621df2723b8176e28418c74500c5dd6ac9ac04b898783d8e0384fc3b4
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\xcpeioop = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
uoqnhdns.exepid process 616 uoqnhdns.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xcpeioop\ImagePath = "C:\\Windows\\SysWOW64\\xcpeioop\\uoqnhdns.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1524 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
uoqnhdns.exedescription pid process target process PID 616 set thread context of 1524 616 uoqnhdns.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1464 sc.exe 388 sc.exe 1472 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exeuoqnhdns.exedescription pid process target process PID 836 wrote to memory of 1476 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe cmd.exe PID 836 wrote to memory of 1476 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe cmd.exe PID 836 wrote to memory of 1476 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe cmd.exe PID 836 wrote to memory of 1476 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe cmd.exe PID 836 wrote to memory of 1620 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe cmd.exe PID 836 wrote to memory of 1620 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe cmd.exe PID 836 wrote to memory of 1620 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe cmd.exe PID 836 wrote to memory of 1620 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe cmd.exe PID 836 wrote to memory of 1464 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 1464 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 1464 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 1464 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 388 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 388 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 388 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 388 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 1472 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 1472 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 1472 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 836 wrote to memory of 1472 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe sc.exe PID 616 wrote to memory of 1524 616 uoqnhdns.exe svchost.exe PID 616 wrote to memory of 1524 616 uoqnhdns.exe svchost.exe PID 616 wrote to memory of 1524 616 uoqnhdns.exe svchost.exe PID 616 wrote to memory of 1524 616 uoqnhdns.exe svchost.exe PID 616 wrote to memory of 1524 616 uoqnhdns.exe svchost.exe PID 616 wrote to memory of 1524 616 uoqnhdns.exe svchost.exe PID 836 wrote to memory of 732 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe netsh.exe PID 836 wrote to memory of 732 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe netsh.exe PID 836 wrote to memory of 732 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe netsh.exe PID 836 wrote to memory of 732 836 1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe"C:\Users\Admin\AppData\Local\Temp\1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xcpeioop\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\uoqnhdns.exe" C:\Windows\SysWOW64\xcpeioop\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create xcpeioop binPath= "C:\Windows\SysWOW64\xcpeioop\uoqnhdns.exe /d\"C:\Users\Admin\AppData\Local\Temp\1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description xcpeioop "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start xcpeioop2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\xcpeioop\uoqnhdns.exeC:\Windows\SysWOW64\xcpeioop\uoqnhdns.exe /d"C:\Users\Admin\AppData\Local\Temp\1c7dfbd2d886ecd2ebfa7f4c6f6e4b9e4fd0f87f628effbfd62a53c3070861b1.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\uoqnhdns.exeFilesize
13.6MB
MD5b228ebe3e4812cbc87623ce486b412ce
SHA11d31fd7d24f41138e8d8faf49ec89f717ebac0e5
SHA256983d4ae2cf317502f34acbb6475678219aac06db99844780f253707d3c08b2c6
SHA512dfdce8aafdf9f0403166094fece44dd84bde58253781b1da28612a4df4482885bcee60f4d4613b32e5576e897b1b986c5e4f4f3361ee3e685d9cf45ded46c315
-
C:\Windows\SysWOW64\xcpeioop\uoqnhdns.exeFilesize
13.6MB
MD5b228ebe3e4812cbc87623ce486b412ce
SHA11d31fd7d24f41138e8d8faf49ec89f717ebac0e5
SHA256983d4ae2cf317502f34acbb6475678219aac06db99844780f253707d3c08b2c6
SHA512dfdce8aafdf9f0403166094fece44dd84bde58253781b1da28612a4df4482885bcee60f4d4613b32e5576e897b1b986c5e4f4f3361ee3e685d9cf45ded46c315
-
memory/388-60-0x0000000000000000-mapping.dmp
-
memory/616-63-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/732-73-0x0000000000000000-mapping.dmp
-
memory/836-55-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB
-
memory/836-54-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1464-59-0x0000000000000000-mapping.dmp
-
memory/1472-61-0x0000000000000000-mapping.dmp
-
memory/1476-56-0x0000000000000000-mapping.dmp
-
memory/1524-68-0x0000000000089A6B-mapping.dmp
-
memory/1524-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1524-65-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1524-72-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1524-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1620-57-0x0000000000000000-mapping.dmp