Analysis
-
max time kernel
146s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-06-2022 03:22
Static task
static1
Behavioral task
behavioral1
Sample
308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe
Resource
win10v2004-20220414-en
General
-
Target
308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe
-
Size
120KB
-
MD5
b84615094beeac27936f9d8838bba53c
-
SHA1
03c41583b675686e05c855c2e891387c88df1933
-
SHA256
308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230
-
SHA512
06e49d5b95e5c601b8813fe21ae3bb0563e5231171b6655eb34a97403fb51d9e0e171d66907958c112cd6b43a61f57e101b6c3a691e8b843a1566c6fd61a621e
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\tftukllh = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
yavmdxex.exepid process 820 yavmdxex.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tftukllh\ImagePath = "C:\\Windows\\SysWOW64\\tftukllh\\yavmdxex.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 680 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
yavmdxex.exedescription pid process target process PID 820 set thread context of 680 820 yavmdxex.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2044 sc.exe 2016 sc.exe 1692 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exeyavmdxex.exedescription pid process target process PID 1964 wrote to memory of 1904 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe cmd.exe PID 1964 wrote to memory of 1904 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe cmd.exe PID 1964 wrote to memory of 1904 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe cmd.exe PID 1964 wrote to memory of 1904 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe cmd.exe PID 1964 wrote to memory of 1296 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe cmd.exe PID 1964 wrote to memory of 1296 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe cmd.exe PID 1964 wrote to memory of 1296 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe cmd.exe PID 1964 wrote to memory of 1296 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe cmd.exe PID 1964 wrote to memory of 2044 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 2044 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 2044 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 2044 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 2016 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 2016 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 2016 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 2016 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 1692 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 1692 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 1692 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 1692 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe sc.exe PID 1964 wrote to memory of 656 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe netsh.exe PID 1964 wrote to memory of 656 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe netsh.exe PID 1964 wrote to memory of 656 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe netsh.exe PID 1964 wrote to memory of 656 1964 308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe netsh.exe PID 820 wrote to memory of 680 820 yavmdxex.exe svchost.exe PID 820 wrote to memory of 680 820 yavmdxex.exe svchost.exe PID 820 wrote to memory of 680 820 yavmdxex.exe svchost.exe PID 820 wrote to memory of 680 820 yavmdxex.exe svchost.exe PID 820 wrote to memory of 680 820 yavmdxex.exe svchost.exe PID 820 wrote to memory of 680 820 yavmdxex.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe"C:\Users\Admin\AppData\Local\Temp\308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tftukllh\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yavmdxex.exe" C:\Windows\SysWOW64\tftukllh\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create tftukllh binPath= "C:\Windows\SysWOW64\tftukllh\yavmdxex.exe /d\"C:\Users\Admin\AppData\Local\Temp\308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description tftukllh "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start tftukllh2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\tftukllh\yavmdxex.exeC:\Windows\SysWOW64\tftukllh\yavmdxex.exe /d"C:\Users\Admin\AppData\Local\Temp\308e929a6159837bfd00254a2a0eb4ca5617b23851044f39835a0f73fda18230.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\yavmdxex.exeFilesize
13.9MB
MD5ec5170e77b48dcc0ba39a7136e7e9d89
SHA162672eba0438f35d4abe68b4f1dbe3d82005ad54
SHA2567c09b0fc07757ff0e0401582633cc537ec6af9cd9406d13b4b3b2c693eb18bec
SHA512d1f191c85105787c2fb6968ea3760201badb57a73418e6fef20c8e4f41f40d77ae077b8bd506e8d5c0d158bcbdec049293c87359d06ec137d6c5067a77e8ca77
-
C:\Windows\SysWOW64\tftukllh\yavmdxex.exeFilesize
13.9MB
MD5ec5170e77b48dcc0ba39a7136e7e9d89
SHA162672eba0438f35d4abe68b4f1dbe3d82005ad54
SHA2567c09b0fc07757ff0e0401582633cc537ec6af9cd9406d13b4b3b2c693eb18bec
SHA512d1f191c85105787c2fb6968ea3760201badb57a73418e6fef20c8e4f41f40d77ae077b8bd506e8d5c0d158bcbdec049293c87359d06ec137d6c5067a77e8ca77
-
memory/656-62-0x0000000000000000-mapping.dmp
-
memory/680-70-0x00000000000C9A6B-mapping.dmp
-
memory/680-75-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/680-74-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/680-73-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/680-67-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/680-69-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/820-65-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1296-57-0x0000000000000000-mapping.dmp
-
memory/1692-61-0x0000000000000000-mapping.dmp
-
memory/1904-56-0x0000000000000000-mapping.dmp
-
memory/1964-55-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1964-54-0x0000000075401000-0x0000000075403000-memory.dmpFilesize
8KB
-
memory/2016-60-0x0000000000000000-mapping.dmp
-
memory/2044-59-0x0000000000000000-mapping.dmp