Analysis
-
max time kernel
132s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-06-2022 14:37
Static task
static1
Behavioral task
behavioral1
Sample
295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe
Resource
win10v2004-20220414-en
General
-
Target
295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe
-
Size
342KB
-
MD5
9b2b3970effdd49a3194b83a272b29bd
-
SHA1
9c141b488d126a2e7f25b541d14307acec0e6262
-
SHA256
295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11
-
SHA512
005dc7ff7bedbb07add0f048690dae179f17421e20ec9f3f63c5f54c65966752a9e46dc062ecbdbcbca7dd92591ac70822eb21c595ef453752ef878cf15a8d7c
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
wnjqhgko.exepid process 672 wnjqhgko.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\jsxxetac\ImagePath = "C:\\Windows\\SysWOW64\\jsxxetac\\wnjqhgko.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1560 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wnjqhgko.exedescription pid process target process PID 672 set thread context of 1560 672 wnjqhgko.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2044 sc.exe 932 sc.exe 1396 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exewnjqhgko.exedescription pid process target process PID 1356 wrote to memory of 988 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe cmd.exe PID 1356 wrote to memory of 988 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe cmd.exe PID 1356 wrote to memory of 988 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe cmd.exe PID 1356 wrote to memory of 988 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe cmd.exe PID 1356 wrote to memory of 1320 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe cmd.exe PID 1356 wrote to memory of 1320 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe cmd.exe PID 1356 wrote to memory of 1320 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe cmd.exe PID 1356 wrote to memory of 1320 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe cmd.exe PID 1356 wrote to memory of 2044 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 2044 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 2044 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 2044 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 932 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 932 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 932 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 932 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 1396 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 1396 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 1396 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 1396 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe sc.exe PID 1356 wrote to memory of 892 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe netsh.exe PID 1356 wrote to memory of 892 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe netsh.exe PID 1356 wrote to memory of 892 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe netsh.exe PID 1356 wrote to memory of 892 1356 295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe netsh.exe PID 672 wrote to memory of 1560 672 wnjqhgko.exe svchost.exe PID 672 wrote to memory of 1560 672 wnjqhgko.exe svchost.exe PID 672 wrote to memory of 1560 672 wnjqhgko.exe svchost.exe PID 672 wrote to memory of 1560 672 wnjqhgko.exe svchost.exe PID 672 wrote to memory of 1560 672 wnjqhgko.exe svchost.exe PID 672 wrote to memory of 1560 672 wnjqhgko.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe"C:\Users\Admin\AppData\Local\Temp\295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jsxxetac\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wnjqhgko.exe" C:\Windows\SysWOW64\jsxxetac\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create jsxxetac binPath= "C:\Windows\SysWOW64\jsxxetac\wnjqhgko.exe /d\"C:\Users\Admin\AppData\Local\Temp\295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description jsxxetac "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start jsxxetac2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\jsxxetac\wnjqhgko.exeC:\Windows\SysWOW64\jsxxetac\wnjqhgko.exe /d"C:\Users\Admin\AppData\Local\Temp\295f2e7a08269def791aa11bfafa9d73e36ac9fa6dd292f2b62b1bcf8758aa11.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\wnjqhgko.exeFilesize
14.7MB
MD5ac6a6856f38540122b02c4025d64b2bc
SHA1fde5ce9bba13bea8e499d511f45ef374a51535b9
SHA256799f98fe2cbca6df850ec23558028e55451d0bde88f65d2d4652f2ebb116b903
SHA512721b5b0f903549d3924761adfe4a8aacfb4568cf294ce0026a249d80cb50559ebc07f99c0edd40e30c56869af3cfc99dd3a4aafccc6aa96bd215d60f90767761
-
C:\Windows\SysWOW64\jsxxetac\wnjqhgko.exeFilesize
14.7MB
MD5ac6a6856f38540122b02c4025d64b2bc
SHA1fde5ce9bba13bea8e499d511f45ef374a51535b9
SHA256799f98fe2cbca6df850ec23558028e55451d0bde88f65d2d4652f2ebb116b903
SHA512721b5b0f903549d3924761adfe4a8aacfb4568cf294ce0026a249d80cb50559ebc07f99c0edd40e30c56869af3cfc99dd3a4aafccc6aa96bd215d60f90767761
-
memory/672-76-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/672-74-0x00000000002C5000-0x00000000002D8000-memory.dmpFilesize
76KB
-
memory/672-67-0x00000000002C5000-0x00000000002D8000-memory.dmpFilesize
76KB
-
memory/892-65-0x0000000000000000-mapping.dmp
-
memory/932-62-0x0000000000000000-mapping.dmp
-
memory/988-58-0x0000000000000000-mapping.dmp
-
memory/1320-59-0x0000000000000000-mapping.dmp
-
memory/1356-54-0x0000000000285000-0x0000000000298000-memory.dmpFilesize
76KB
-
memory/1356-66-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1356-57-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1356-56-0x0000000000285000-0x0000000000298000-memory.dmpFilesize
76KB
-
memory/1356-55-0x0000000075361000-0x0000000075363000-memory.dmpFilesize
8KB
-
memory/1396-63-0x0000000000000000-mapping.dmp
-
memory/1560-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1560-71-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1560-72-0x0000000000089A6B-mapping.dmp
-
memory/1560-79-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1560-80-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/2044-61-0x0000000000000000-mapping.dmp