Analysis
-
max time kernel
146s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
22-06-2022 12:34
Static task
static1
Behavioral task
behavioral1
Sample
2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe
Resource
win10v2004-20220414-en
General
-
Target
2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe
-
Size
137KB
-
MD5
2ccea0b6d24c740b88eb1ac98db1548f
-
SHA1
38fc1c6b54b9d0804340d99f9e0c14bd566c4dad
-
SHA256
2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5
-
SHA512
a0b225e1835efd43fb69b2c429da8bef2a30a518ab59940e9d35bab45cc37c1d5817ede5f07b5995ceec2d0d292fb850d736003a8222a43c8214432addce5d0e
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\blbflvzz = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
kxnwhuhb.exepid process 432 kxnwhuhb.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\blbflvzz\ImagePath = "C:\\Windows\\SysWOW64\\blbflvzz\\kxnwhuhb.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1296 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
kxnwhuhb.exedescription pid process target process PID 432 set thread context of 1296 432 kxnwhuhb.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 952 sc.exe 240 sc.exe 664 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exekxnwhuhb.exedescription pid process target process PID 2032 wrote to memory of 1724 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe cmd.exe PID 2032 wrote to memory of 1724 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe cmd.exe PID 2032 wrote to memory of 1724 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe cmd.exe PID 2032 wrote to memory of 1724 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe cmd.exe PID 2032 wrote to memory of 1536 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe cmd.exe PID 2032 wrote to memory of 1536 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe cmd.exe PID 2032 wrote to memory of 1536 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe cmd.exe PID 2032 wrote to memory of 1536 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe cmd.exe PID 2032 wrote to memory of 952 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 952 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 952 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 952 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 240 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 240 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 240 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 240 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 664 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 664 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 664 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 664 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe sc.exe PID 2032 wrote to memory of 508 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe netsh.exe PID 2032 wrote to memory of 508 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe netsh.exe PID 2032 wrote to memory of 508 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe netsh.exe PID 2032 wrote to memory of 508 2032 2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe netsh.exe PID 432 wrote to memory of 1296 432 kxnwhuhb.exe svchost.exe PID 432 wrote to memory of 1296 432 kxnwhuhb.exe svchost.exe PID 432 wrote to memory of 1296 432 kxnwhuhb.exe svchost.exe PID 432 wrote to memory of 1296 432 kxnwhuhb.exe svchost.exe PID 432 wrote to memory of 1296 432 kxnwhuhb.exe svchost.exe PID 432 wrote to memory of 1296 432 kxnwhuhb.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe"C:\Users\Admin\AppData\Local\Temp\2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\blbflvzz\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kxnwhuhb.exe" C:\Windows\SysWOW64\blbflvzz\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create blbflvzz binPath= "C:\Windows\SysWOW64\blbflvzz\kxnwhuhb.exe /d\"C:\Users\Admin\AppData\Local\Temp\2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description blbflvzz "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start blbflvzz2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\blbflvzz\kxnwhuhb.exeC:\Windows\SysWOW64\blbflvzz\kxnwhuhb.exe /d"C:\Users\Admin\AppData\Local\Temp\2e0a35235d3eaf1073af214c45b50f60639cd9e9050b990611302493caf666a5.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\kxnwhuhb.exeFilesize
10.8MB
MD599638efde63cd875ac31aa8113db70a9
SHA1a8d95f972b1d9027dfdd63d75c6e2e2f52d7efde
SHA256e13bed5080ea30776923ad5395082d11dd1027277e7f7bd96fe043a75cd10da1
SHA5120716b4d9c0be6201329b14939c06171325adf93ea784728dda808fd9a7cfe76a3e5155489c2f701714dc5d248fe5db401e1cef41b4dc6fb8717da01f2c1c3147
-
C:\Windows\SysWOW64\blbflvzz\kxnwhuhb.exeFilesize
10.8MB
MD599638efde63cd875ac31aa8113db70a9
SHA1a8d95f972b1d9027dfdd63d75c6e2e2f52d7efde
SHA256e13bed5080ea30776923ad5395082d11dd1027277e7f7bd96fe043a75cd10da1
SHA5120716b4d9c0be6201329b14939c06171325adf93ea784728dda808fd9a7cfe76a3e5155489c2f701714dc5d248fe5db401e1cef41b4dc6fb8717da01f2c1c3147
-
memory/240-60-0x0000000000000000-mapping.dmp
-
memory/432-65-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/508-62-0x0000000000000000-mapping.dmp
-
memory/664-61-0x0000000000000000-mapping.dmp
-
memory/952-59-0x0000000000000000-mapping.dmp
-
memory/1296-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1296-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1296-70-0x0000000000089A6B-mapping.dmp
-
memory/1296-73-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1296-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1296-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1536-57-0x0000000000000000-mapping.dmp
-
memory/1724-56-0x0000000000000000-mapping.dmp
-
memory/2032-54-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/2032-55-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB