Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-06-2022 07:39
Static task
static1
Behavioral task
behavioral1
Sample
39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe
Resource
win10v2004-20220414-en
General
-
Target
39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe
-
Size
312KB
-
MD5
469c2f23c85976e2d7a79c013b87121b
-
SHA1
a98f1b95299a2546aca7e959b9af97eed341a01b
-
SHA256
39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9
-
SHA512
1ef5fdeb5f0fd3872d351c93c661fdebc504cec452ff9e00ab3abc7a84aea0be9ba3d2de52e7c3c900b67b55d95c2422d0cdc2ed16ada940a4f662ac884559c9
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
dpqkfbcz.exepid process 4824 dpqkfbcz.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\chzsescb\ImagePath = "C:\\Windows\\SysWOW64\\chzsescb\\dpqkfbcz.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dpqkfbcz.exedescription pid process target process PID 4824 set thread context of 2260 4824 dpqkfbcz.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 5108 sc.exe 1688 sc.exe 2160 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exedpqkfbcz.exedescription pid process target process PID 4756 wrote to memory of 4696 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe cmd.exe PID 4756 wrote to memory of 4696 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe cmd.exe PID 4756 wrote to memory of 4696 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe cmd.exe PID 4756 wrote to memory of 4700 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe cmd.exe PID 4756 wrote to memory of 4700 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe cmd.exe PID 4756 wrote to memory of 4700 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe cmd.exe PID 4756 wrote to memory of 1688 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe sc.exe PID 4756 wrote to memory of 1688 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe sc.exe PID 4756 wrote to memory of 1688 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe sc.exe PID 4756 wrote to memory of 2160 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe sc.exe PID 4756 wrote to memory of 2160 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe sc.exe PID 4756 wrote to memory of 2160 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe sc.exe PID 4756 wrote to memory of 5108 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe sc.exe PID 4756 wrote to memory of 5108 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe sc.exe PID 4756 wrote to memory of 5108 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe sc.exe PID 4756 wrote to memory of 1340 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe netsh.exe PID 4756 wrote to memory of 1340 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe netsh.exe PID 4756 wrote to memory of 1340 4756 39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe netsh.exe PID 4824 wrote to memory of 2260 4824 dpqkfbcz.exe svchost.exe PID 4824 wrote to memory of 2260 4824 dpqkfbcz.exe svchost.exe PID 4824 wrote to memory of 2260 4824 dpqkfbcz.exe svchost.exe PID 4824 wrote to memory of 2260 4824 dpqkfbcz.exe svchost.exe PID 4824 wrote to memory of 2260 4824 dpqkfbcz.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe"C:\Users\Admin\AppData\Local\Temp\39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\chzsescb\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dpqkfbcz.exe" C:\Windows\SysWOW64\chzsescb\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create chzsescb binPath= "C:\Windows\SysWOW64\chzsescb\dpqkfbcz.exe /d\"C:\Users\Admin\AppData\Local\Temp\39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description chzsescb "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start chzsescb2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\chzsescb\dpqkfbcz.exeC:\Windows\SysWOW64\chzsescb\dpqkfbcz.exe /d"C:\Users\Admin\AppData\Local\Temp\39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dpqkfbcz.exeFilesize
11.2MB
MD57d76a3b75d8a03c2ccf4f71372090397
SHA1d035a238b3b72b66e518ff64f0b82e5a34975f9c
SHA256dc3a52c38c6da2022021d001352377c4cefc57f2cda0cbd51bd59fdacd5da7e6
SHA512d8dd67095c0de101c191e104caab0f935c7b0f29a37f10c269226ff01fffb94e585bc736882ac6d7b0e77544136ebd93d2c2743501e8da6c7092265d7706439c
-
C:\Windows\SysWOW64\chzsescb\dpqkfbcz.exeFilesize
11.2MB
MD57d76a3b75d8a03c2ccf4f71372090397
SHA1d035a238b3b72b66e518ff64f0b82e5a34975f9c
SHA256dc3a52c38c6da2022021d001352377c4cefc57f2cda0cbd51bd59fdacd5da7e6
SHA512d8dd67095c0de101c191e104caab0f935c7b0f29a37f10c269226ff01fffb94e585bc736882ac6d7b0e77544136ebd93d2c2743501e8da6c7092265d7706439c
-
memory/1340-139-0x0000000000000000-mapping.dmp
-
memory/1688-136-0x0000000000000000-mapping.dmp
-
memory/2160-137-0x0000000000000000-mapping.dmp
-
memory/2260-145-0x0000000000FE0000-0x0000000000FF5000-memory.dmpFilesize
84KB
-
memory/2260-151-0x0000000000FE0000-0x0000000000FF5000-memory.dmpFilesize
84KB
-
memory/2260-150-0x0000000000FE0000-0x0000000000FF5000-memory.dmpFilesize
84KB
-
memory/2260-144-0x0000000000000000-mapping.dmp
-
memory/4696-132-0x0000000000000000-mapping.dmp
-
memory/4700-134-0x0000000000000000-mapping.dmp
-
memory/4756-131-0x0000000000588000-0x0000000000599000-memory.dmpFilesize
68KB
-
memory/4756-141-0x0000000000400000-0x00000000004FA000-memory.dmpFilesize
1000KB
-
memory/4756-140-0x0000000000588000-0x0000000000599000-memory.dmpFilesize
68KB
-
memory/4756-130-0x0000000000588000-0x0000000000599000-memory.dmpFilesize
68KB
-
memory/4756-133-0x0000000000400000-0x00000000004FA000-memory.dmpFilesize
1000KB
-
memory/4824-143-0x00000000008A4000-0x00000000008B5000-memory.dmpFilesize
68KB
-
memory/4824-148-0x00000000008A4000-0x00000000008B5000-memory.dmpFilesize
68KB
-
memory/4824-149-0x0000000000400000-0x00000000004FA000-memory.dmpFilesize
1000KB
-
memory/5108-138-0x0000000000000000-mapping.dmp