Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-06-2022 01:05
Static task
static1
Behavioral task
behavioral1
Sample
2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe
Resource
win10v2004-20220414-en
General
-
Target
2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe
-
Size
142KB
-
MD5
c20d3f9c5dcd93a3dfd3b6e9aeea2541
-
SHA1
c829d1ab536df96bcc67f136c8453b51e8407934
-
SHA256
2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488
-
SHA512
4dec42790939d1d486de2c43e802583c60ff984f1c7ed4c40b744635f3a0ec2c8c9c49c3bb6f2d1942cab0da21f61a62a62aaa07381cbc841ef5a49adf3195d9
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\hsfzauea = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
mmsoccia.exepid process 1128 mmsoccia.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\hsfzauea\ImagePath = "C:\\Windows\\SysWOW64\\hsfzauea\\mmsoccia.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1864 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mmsoccia.exedescription pid process target process PID 1128 set thread context of 1864 1128 mmsoccia.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1060 sc.exe 912 sc.exe 1556 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exemmsoccia.exedescription pid process target process PID 1464 wrote to memory of 820 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe cmd.exe PID 1464 wrote to memory of 820 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe cmd.exe PID 1464 wrote to memory of 820 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe cmd.exe PID 1464 wrote to memory of 820 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe cmd.exe PID 1464 wrote to memory of 1744 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe cmd.exe PID 1464 wrote to memory of 1744 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe cmd.exe PID 1464 wrote to memory of 1744 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe cmd.exe PID 1464 wrote to memory of 1744 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe cmd.exe PID 1464 wrote to memory of 1060 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 1060 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 1060 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 1060 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 912 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 912 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 912 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 912 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 1556 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 1556 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 1556 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 1556 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe sc.exe PID 1464 wrote to memory of 1696 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe netsh.exe PID 1464 wrote to memory of 1696 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe netsh.exe PID 1464 wrote to memory of 1696 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe netsh.exe PID 1464 wrote to memory of 1696 1464 2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe netsh.exe PID 1128 wrote to memory of 1864 1128 mmsoccia.exe svchost.exe PID 1128 wrote to memory of 1864 1128 mmsoccia.exe svchost.exe PID 1128 wrote to memory of 1864 1128 mmsoccia.exe svchost.exe PID 1128 wrote to memory of 1864 1128 mmsoccia.exe svchost.exe PID 1128 wrote to memory of 1864 1128 mmsoccia.exe svchost.exe PID 1128 wrote to memory of 1864 1128 mmsoccia.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe"C:\Users\Admin\AppData\Local\Temp\2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hsfzauea\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\mmsoccia.exe" C:\Windows\SysWOW64\hsfzauea\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create hsfzauea binPath= "C:\Windows\SysWOW64\hsfzauea\mmsoccia.exe /d\"C:\Users\Admin\AppData\Local\Temp\2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description hsfzauea "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start hsfzauea2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\hsfzauea\mmsoccia.exeC:\Windows\SysWOW64\hsfzauea\mmsoccia.exe /d"C:\Users\Admin\AppData\Local\Temp\2391d4e6b02d6ba9ce47ca34a88260c83c2f72a0886932be5a63c117a31c9488.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\mmsoccia.exeFilesize
11.5MB
MD5cbf4e0d7b4a6fd43d768bbd5ed812de5
SHA13131d98644079e4e4bc08db96f079fdce560404f
SHA2566150ae456148fa1be0244cf4f915a6a9ed7c8b912e5b217ae1613fabf6e4d628
SHA5124da7edd53a016e189be943d0012e0810463557db26dbe62a9f9a312048b3fcbdd296e414239d8f748f5ac839d5ae8c40284cafe5ad6b63c5283cdf2b89e0c89a
-
C:\Windows\SysWOW64\hsfzauea\mmsoccia.exeFilesize
11.5MB
MD5cbf4e0d7b4a6fd43d768bbd5ed812de5
SHA13131d98644079e4e4bc08db96f079fdce560404f
SHA2566150ae456148fa1be0244cf4f915a6a9ed7c8b912e5b217ae1613fabf6e4d628
SHA5124da7edd53a016e189be943d0012e0810463557db26dbe62a9f9a312048b3fcbdd296e414239d8f748f5ac839d5ae8c40284cafe5ad6b63c5283cdf2b89e0c89a
-
memory/820-56-0x0000000000000000-mapping.dmp
-
memory/912-60-0x0000000000000000-mapping.dmp
-
memory/1060-59-0x0000000000000000-mapping.dmp
-
memory/1128-65-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1464-55-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/1464-54-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1556-61-0x0000000000000000-mapping.dmp
-
memory/1696-62-0x0000000000000000-mapping.dmp
-
memory/1744-57-0x0000000000000000-mapping.dmp
-
memory/1864-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1864-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1864-70-0x0000000000089A6B-mapping.dmp
-
memory/1864-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1864-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB