Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-06-2022 17:05
Static task
static1
Behavioral task
behavioral1
Sample
2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe
Resource
win10v2004-20220414-en
General
-
Target
2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe
-
Size
143KB
-
MD5
dd7f8116f16c8e53b2c25def6db171c9
-
SHA1
7490dc96c28d8ef777bfa834576a0121c14525cb
-
SHA256
2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b
-
SHA512
6b45456f69753baf62834984ccc9ac2a48c7878e22ef805c93263463d6e73caffcde34aa338a655925d490a4c62395124e2a208ff288e7fd9ec2b28e2511a88f
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\mxgnlgb = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
nkvhbcg.exepid process 892 nkvhbcg.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mxgnlgb\ImagePath = "C:\\Windows\\SysWOW64\\mxgnlgb\\nkvhbcg.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1060 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
nkvhbcg.exedescription pid process target process PID 892 set thread context of 1060 892 nkvhbcg.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1336 sc.exe 1708 sc.exe 740 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exenkvhbcg.exedescription pid process target process PID 1796 wrote to memory of 1956 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe cmd.exe PID 1796 wrote to memory of 1956 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe cmd.exe PID 1796 wrote to memory of 1956 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe cmd.exe PID 1796 wrote to memory of 1956 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe cmd.exe PID 1796 wrote to memory of 1352 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe cmd.exe PID 1796 wrote to memory of 1352 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe cmd.exe PID 1796 wrote to memory of 1352 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe cmd.exe PID 1796 wrote to memory of 1352 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe cmd.exe PID 1796 wrote to memory of 1336 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 1336 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 1336 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 1336 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 1708 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 1708 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 1708 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 1708 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 740 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 740 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 740 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 740 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe sc.exe PID 1796 wrote to memory of 2020 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe netsh.exe PID 1796 wrote to memory of 2020 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe netsh.exe PID 1796 wrote to memory of 2020 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe netsh.exe PID 1796 wrote to memory of 2020 1796 2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe netsh.exe PID 892 wrote to memory of 1060 892 nkvhbcg.exe svchost.exe PID 892 wrote to memory of 1060 892 nkvhbcg.exe svchost.exe PID 892 wrote to memory of 1060 892 nkvhbcg.exe svchost.exe PID 892 wrote to memory of 1060 892 nkvhbcg.exe svchost.exe PID 892 wrote to memory of 1060 892 nkvhbcg.exe svchost.exe PID 892 wrote to memory of 1060 892 nkvhbcg.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe"C:\Users\Admin\AppData\Local\Temp\2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mxgnlgb\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nkvhbcg.exe" C:\Windows\SysWOW64\mxgnlgb\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create mxgnlgb binPath= "C:\Windows\SysWOW64\mxgnlgb\nkvhbcg.exe /d\"C:\Users\Admin\AppData\Local\Temp\2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description mxgnlgb "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start mxgnlgb2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mxgnlgb\nkvhbcg.exeC:\Windows\SysWOW64\mxgnlgb\nkvhbcg.exe /d"C:\Users\Admin\AppData\Local\Temp\2897e555be336cb52bf83da45ca4cf28ec455f06ad960bb41b1b08bfcc80d74b.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nkvhbcg.exeFilesize
11.6MB
MD5980e8f4b0ffe211c8aeb3cd8e135a50d
SHA17e68ba177dce5cd62344f8c59e925ef7d8fb386e
SHA2566b2c4aa925f5282796912e5bbef047e040379fa48a8d5af705e162bca916590c
SHA512d595c80d8902b41877a43cc2f1fb351d4c048e72380c2f6c2ead978c61e59601d69c82dc2148287d45dba34108951365ced734944d86b8b28d4be06bbc571385
-
C:\Windows\SysWOW64\mxgnlgb\nkvhbcg.exeFilesize
11.6MB
MD5980e8f4b0ffe211c8aeb3cd8e135a50d
SHA17e68ba177dce5cd62344f8c59e925ef7d8fb386e
SHA2566b2c4aa925f5282796912e5bbef047e040379fa48a8d5af705e162bca916590c
SHA512d595c80d8902b41877a43cc2f1fb351d4c048e72380c2f6c2ead978c61e59601d69c82dc2148287d45dba34108951365ced734944d86b8b28d4be06bbc571385
-
memory/740-61-0x0000000000000000-mapping.dmp
-
memory/892-65-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1060-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1060-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1060-70-0x0000000000089A6B-mapping.dmp
-
memory/1060-73-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1060-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1060-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1336-59-0x0000000000000000-mapping.dmp
-
memory/1352-57-0x0000000000000000-mapping.dmp
-
memory/1708-60-0x0000000000000000-mapping.dmp
-
memory/1796-55-0x0000000075951000-0x0000000075953000-memory.dmpFilesize
8KB
-
memory/1796-54-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1956-56-0x0000000000000000-mapping.dmp
-
memory/2020-62-0x0000000000000000-mapping.dmp