Analysis
-
max time kernel
151s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-06-2022 02:45
Static task
static1
Behavioral task
behavioral1
Sample
23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe
Resource
win10v2004-20220414-en
General
-
Target
23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe
-
Size
101KB
-
MD5
fc3b31c8214d209f6783baedfbfd514b
-
SHA1
f457e855dea420e7ae69129d1437b31c33b78d25
-
SHA256
23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855
-
SHA512
6232c34e88c1da8fd9d13cd6c81bce59b7552ade20d2e0df736334ae96f9501eb1e63f4f3dbc207e8096c7e3a2111db2c73067c84b50a6da2a62285c789d7eb4
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\evdefbyz = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
ehppnlpy.exepid process 928 ehppnlpy.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\evdefbyz\ImagePath = "C:\\Windows\\SysWOW64\\evdefbyz\\ehppnlpy.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1748 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ehppnlpy.exedescription pid process target process PID 928 set thread context of 1748 928 ehppnlpy.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 240 sc.exe 1756 sc.exe 1692 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exeehppnlpy.exedescription pid process target process PID 1884 wrote to memory of 1580 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe cmd.exe PID 1884 wrote to memory of 1580 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe cmd.exe PID 1884 wrote to memory of 1580 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe cmd.exe PID 1884 wrote to memory of 1580 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe cmd.exe PID 1884 wrote to memory of 1632 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe cmd.exe PID 1884 wrote to memory of 1632 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe cmd.exe PID 1884 wrote to memory of 1632 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe cmd.exe PID 1884 wrote to memory of 1632 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe cmd.exe PID 1884 wrote to memory of 240 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 240 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 240 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 240 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 1756 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 1756 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 1756 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 1756 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 1692 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 1692 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 1692 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 1692 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe sc.exe PID 1884 wrote to memory of 1656 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe netsh.exe PID 1884 wrote to memory of 1656 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe netsh.exe PID 1884 wrote to memory of 1656 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe netsh.exe PID 1884 wrote to memory of 1656 1884 23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe netsh.exe PID 928 wrote to memory of 1748 928 ehppnlpy.exe svchost.exe PID 928 wrote to memory of 1748 928 ehppnlpy.exe svchost.exe PID 928 wrote to memory of 1748 928 ehppnlpy.exe svchost.exe PID 928 wrote to memory of 1748 928 ehppnlpy.exe svchost.exe PID 928 wrote to memory of 1748 928 ehppnlpy.exe svchost.exe PID 928 wrote to memory of 1748 928 ehppnlpy.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe"C:\Users\Admin\AppData\Local\Temp\23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\evdefbyz\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ehppnlpy.exe" C:\Windows\SysWOW64\evdefbyz\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create evdefbyz binPath= "C:\Windows\SysWOW64\evdefbyz\ehppnlpy.exe /d\"C:\Users\Admin\AppData\Local\Temp\23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description evdefbyz "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start evdefbyz2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\evdefbyz\ehppnlpy.exeC:\Windows\SysWOW64\evdefbyz\ehppnlpy.exe /d"C:\Users\Admin\AppData\Local\Temp\23197502be28aab6501b23608fd0f3d82bbf096fd990db91f6bbfc1dc41ff855.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ehppnlpy.exeFilesize
11.7MB
MD50a501128a0c00067d1f32ac9aca86dc2
SHA1040311600372bf4ebe4e180624e06ee8f617ff29
SHA256987268e7b9bc6aba3e3665b434467a376e892af33ef16e19554f64257cb135da
SHA5120b067548d8ae0d25141a67106752157122afaf3438e15f45c98fde683ce28ba43448fe66826cef25a93405f98072e0acdd36c1d815f9c68ab2976f1897969b0c
-
C:\Windows\SysWOW64\evdefbyz\ehppnlpy.exeFilesize
11.7MB
MD50a501128a0c00067d1f32ac9aca86dc2
SHA1040311600372bf4ebe4e180624e06ee8f617ff29
SHA256987268e7b9bc6aba3e3665b434467a376e892af33ef16e19554f64257cb135da
SHA5120b067548d8ae0d25141a67106752157122afaf3438e15f45c98fde683ce28ba43448fe66826cef25a93405f98072e0acdd36c1d815f9c68ab2976f1897969b0c
-
memory/240-59-0x0000000000000000-mapping.dmp
-
memory/928-63-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1580-56-0x0000000000000000-mapping.dmp
-
memory/1632-57-0x0000000000000000-mapping.dmp
-
memory/1656-65-0x0000000000000000-mapping.dmp
-
memory/1692-61-0x0000000000000000-mapping.dmp
-
memory/1748-66-0x0000000000110000-0x0000000000125000-memory.dmpFilesize
84KB
-
memory/1748-68-0x0000000000110000-0x0000000000125000-memory.dmpFilesize
84KB
-
memory/1748-69-0x0000000000119A6B-mapping.dmp
-
memory/1748-72-0x0000000000110000-0x0000000000125000-memory.dmpFilesize
84KB
-
memory/1748-73-0x0000000000110000-0x0000000000125000-memory.dmpFilesize
84KB
-
memory/1748-75-0x0000000000110000-0x0000000000125000-memory.dmpFilesize
84KB
-
memory/1756-60-0x0000000000000000-mapping.dmp
-
memory/1884-54-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1884-55-0x00000000759E1000-0x00000000759E3000-memory.dmpFilesize
8KB