Analysis
-
max time kernel
145s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
22-06-2022 07:36
Static task
static1
Behavioral task
behavioral1
Sample
2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe
Resource
win10v2004-20220414-en
General
-
Target
2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe
-
Size
142KB
-
MD5
5e40852b1b836ae50ea61b4dc56124e9
-
SHA1
b01babd89da56da58ae26ea756bfe6dbdbc917d5
-
SHA256
2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59
-
SHA512
7e57324bafde20171129bd0a873654cece5827e93a00423bf98a89612343cd483fd67556dedaa72c5ae92f2a603c9dfab880881d986722d1403c508b523bc276
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
aibrwtlv.exepid process 1052 aibrwtlv.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mtstupzc\ImagePath = "C:\\Windows\\SysWOW64\\mtstupzc\\aibrwtlv.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1188 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aibrwtlv.exedescription pid process target process PID 1052 set thread context of 1188 1052 aibrwtlv.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1996 sc.exe 1312 sc.exe 812 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exeaibrwtlv.exedescription pid process target process PID 1648 wrote to memory of 2044 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe cmd.exe PID 1648 wrote to memory of 2044 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe cmd.exe PID 1648 wrote to memory of 2044 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe cmd.exe PID 1648 wrote to memory of 2044 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe cmd.exe PID 1648 wrote to memory of 2012 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe cmd.exe PID 1648 wrote to memory of 2012 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe cmd.exe PID 1648 wrote to memory of 2012 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe cmd.exe PID 1648 wrote to memory of 2012 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe cmd.exe PID 1648 wrote to memory of 1996 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 1996 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 1996 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 1996 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 1312 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 1312 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 1312 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 1312 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 812 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 812 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 812 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 812 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe sc.exe PID 1648 wrote to memory of 1464 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe netsh.exe PID 1648 wrote to memory of 1464 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe netsh.exe PID 1648 wrote to memory of 1464 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe netsh.exe PID 1648 wrote to memory of 1464 1648 2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe netsh.exe PID 1052 wrote to memory of 1188 1052 aibrwtlv.exe svchost.exe PID 1052 wrote to memory of 1188 1052 aibrwtlv.exe svchost.exe PID 1052 wrote to memory of 1188 1052 aibrwtlv.exe svchost.exe PID 1052 wrote to memory of 1188 1052 aibrwtlv.exe svchost.exe PID 1052 wrote to memory of 1188 1052 aibrwtlv.exe svchost.exe PID 1052 wrote to memory of 1188 1052 aibrwtlv.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe"C:\Users\Admin\AppData\Local\Temp\2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mtstupzc\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\aibrwtlv.exe" C:\Windows\SysWOW64\mtstupzc\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create mtstupzc binPath= "C:\Windows\SysWOW64\mtstupzc\aibrwtlv.exe /d\"C:\Users\Admin\AppData\Local\Temp\2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description mtstupzc "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start mtstupzc2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mtstupzc\aibrwtlv.exeC:\Windows\SysWOW64\mtstupzc\aibrwtlv.exe /d"C:\Users\Admin\AppData\Local\Temp\2ea3f9f2f531dc5153dd2e93f7cc763ce3e425c67eb64dcd06f5204598649b59.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\aibrwtlv.exeFilesize
12.8MB
MD5f15cea646962e9e530985ab2f634d9ec
SHA1ea61686227e7e3c11952cbacf8335b88cd0a9706
SHA256e3ff3fce5fe18c6e874e5c1c2c05c23d2ee92da46b5429b977e7b7de0fd88401
SHA512534d26001b48294ad1fe357c92c6f87edb9b834db526d35da65dc29c848dfea90787e94ef63fb7b4414a3d485a3523898d85a8e437daf87ebdb61649bf369bdc
-
C:\Windows\SysWOW64\mtstupzc\aibrwtlv.exeFilesize
12.8MB
MD5f15cea646962e9e530985ab2f634d9ec
SHA1ea61686227e7e3c11952cbacf8335b88cd0a9706
SHA256e3ff3fce5fe18c6e874e5c1c2c05c23d2ee92da46b5429b977e7b7de0fd88401
SHA512534d26001b48294ad1fe357c92c6f87edb9b834db526d35da65dc29c848dfea90787e94ef63fb7b4414a3d485a3523898d85a8e437daf87ebdb61649bf369bdc
-
memory/812-61-0x0000000000000000-mapping.dmp
-
memory/1052-65-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1188-69-0x0000000000100000-0x0000000000115000-memory.dmpFilesize
84KB
-
memory/1188-67-0x0000000000100000-0x0000000000115000-memory.dmpFilesize
84KB
-
memory/1188-70-0x0000000000109A6B-mapping.dmp
-
memory/1188-73-0x0000000000100000-0x0000000000115000-memory.dmpFilesize
84KB
-
memory/1188-74-0x0000000000100000-0x0000000000115000-memory.dmpFilesize
84KB
-
memory/1188-75-0x0000000000100000-0x0000000000115000-memory.dmpFilesize
84KB
-
memory/1312-60-0x0000000000000000-mapping.dmp
-
memory/1464-62-0x0000000000000000-mapping.dmp
-
memory/1648-55-0x00000000755B1000-0x00000000755B3000-memory.dmpFilesize
8KB
-
memory/1648-54-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1996-59-0x0000000000000000-mapping.dmp
-
memory/2012-57-0x0000000000000000-mapping.dmp
-
memory/2044-56-0x0000000000000000-mapping.dmp