Analysis
-
max time kernel
212s -
max time network
226s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-06-2022 12:59
Static task
static1
Behavioral task
behavioral1
Sample
204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe
Resource
win10v2004-20220414-en
General
-
Target
204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe
-
Size
143KB
-
MD5
6a07816512f5c3fc626e4f8fcc9b0058
-
SHA1
217533c5246f3133256dbf6cf09f450bd7e3edcd
-
SHA256
204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257
-
SHA512
1e65a4680b1e3e2fb94e3a7e0fe53189ebe306bfe61d2a18b3ae4226e28078cd37ad0fcaba58de5b0b542d205b9152c26e32cd596e2954f29cb200b816bfc721
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
hhnjxxdv.exepid process 832 hhnjxxdv.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\zxsshzty\ImagePath = "C:\\Windows\\SysWOW64\\zxsshzty\\hhnjxxdv.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1560 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
hhnjxxdv.exedescription pid process target process PID 832 set thread context of 1560 832 hhnjxxdv.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1284 sc.exe 1792 sc.exe 932 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exehhnjxxdv.exedescription pid process target process PID 1840 wrote to memory of 632 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe cmd.exe PID 1840 wrote to memory of 632 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe cmd.exe PID 1840 wrote to memory of 632 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe cmd.exe PID 1840 wrote to memory of 632 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe cmd.exe PID 1840 wrote to memory of 1380 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe cmd.exe PID 1840 wrote to memory of 1380 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe cmd.exe PID 1840 wrote to memory of 1380 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe cmd.exe PID 1840 wrote to memory of 1380 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe cmd.exe PID 1840 wrote to memory of 1284 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 1284 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 1284 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 1284 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 1792 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 1792 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 1792 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 1792 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 932 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 932 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 932 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 932 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe sc.exe PID 1840 wrote to memory of 1680 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe netsh.exe PID 1840 wrote to memory of 1680 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe netsh.exe PID 1840 wrote to memory of 1680 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe netsh.exe PID 1840 wrote to memory of 1680 1840 204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe netsh.exe PID 832 wrote to memory of 1560 832 hhnjxxdv.exe svchost.exe PID 832 wrote to memory of 1560 832 hhnjxxdv.exe svchost.exe PID 832 wrote to memory of 1560 832 hhnjxxdv.exe svchost.exe PID 832 wrote to memory of 1560 832 hhnjxxdv.exe svchost.exe PID 832 wrote to memory of 1560 832 hhnjxxdv.exe svchost.exe PID 832 wrote to memory of 1560 832 hhnjxxdv.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe"C:\Users\Admin\AppData\Local\Temp\204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zxsshzty\2⤵PID:632
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hhnjxxdv.exe" C:\Windows\SysWOW64\zxsshzty\2⤵PID:1380
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create zxsshzty binPath= "C:\Windows\SysWOW64\zxsshzty\hhnjxxdv.exe /d\"C:\Users\Admin\AppData\Local\Temp\204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:1284 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description zxsshzty "wifi internet conection"2⤵
- Launches sc.exe
PID:1792 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start zxsshzty2⤵
- Launches sc.exe
PID:932 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:1680
-
C:\Windows\SysWOW64\zxsshzty\hhnjxxdv.exeC:\Windows\SysWOW64\zxsshzty\hhnjxxdv.exe /d"C:\Users\Admin\AppData\Local\Temp\204e71a886288bb5d37336b601c608f2b2ce3b8cf3003adef9a3db70d13f0257.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:1560
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hhnjxxdv.exeFilesize
13.5MB
MD51dca3615722cad90c41f28b6e6d6386a
SHA15bf6275b7e96d7c6c3363e85a976c669d8c52b69
SHA2564bef4668cd937a13bde3798f21dcace5f769a7d925d1b895f92f126d312c9465
SHA51212db228ef7d1d0c48cff9d2dfcc3c2b78f030f1c69b96f8927fbc57d1531b07ae81dba54781c9b7a8e55d741348701b846f9843002631ef24e28af89ff7d057e
-
C:\Windows\SysWOW64\zxsshzty\hhnjxxdv.exeFilesize
13.5MB
MD51dca3615722cad90c41f28b6e6d6386a
SHA15bf6275b7e96d7c6c3363e85a976c669d8c52b69
SHA2564bef4668cd937a13bde3798f21dcace5f769a7d925d1b895f92f126d312c9465
SHA51212db228ef7d1d0c48cff9d2dfcc3c2b78f030f1c69b96f8927fbc57d1531b07ae81dba54781c9b7a8e55d741348701b846f9843002631ef24e28af89ff7d057e
-
memory/632-56-0x0000000000000000-mapping.dmp
-
memory/832-65-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/932-61-0x0000000000000000-mapping.dmp
-
memory/1284-59-0x0000000000000000-mapping.dmp
-
memory/1380-57-0x0000000000000000-mapping.dmp
-
memory/1560-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1560-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1560-70-0x0000000000089A6B-mapping.dmp
-
memory/1560-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1560-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1680-62-0x0000000000000000-mapping.dmp
-
memory/1792-60-0x0000000000000000-mapping.dmp
-
memory/1840-55-0x0000000074F91000-0x0000000074F93000-memory.dmpFilesize
8KB
-
memory/1840-54-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB