Analysis
-
max time kernel
208s -
max time network
222s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
26-06-2022 01:13
Static task
static1
Behavioral task
behavioral1
Sample
36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe
Resource
win10v2004-20220414-en
General
-
Target
36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe
-
Size
108KB
-
MD5
3a7c9b7345930efda1b033b5ffd6888c
-
SHA1
cce9d9ece4bbf8666894d3d52ba3bcf243140a12
-
SHA256
36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701
-
SHA512
8b76eba6a981f493b1afac3a39d62f2c91eb1919dcb439f9d9b6aa86bce20e8c66c7a91f33d0f64244cde8c974a5cffe70384320db388b71d268f9e3938d0d9a
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
zbwneyfy.exepid process 1968 zbwneyfy.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\bkbmtzds\ImagePath = "C:\\Windows\\SysWOW64\\bkbmtzds\\zbwneyfy.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1252 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
zbwneyfy.exedescription pid process target process PID 1968 set thread context of 1252 1968 zbwneyfy.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 544 sc.exe 1016 sc.exe 588 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exezbwneyfy.exedescription pid process target process PID 1344 wrote to memory of 628 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe cmd.exe PID 1344 wrote to memory of 628 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe cmd.exe PID 1344 wrote to memory of 628 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe cmd.exe PID 1344 wrote to memory of 628 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe cmd.exe PID 1344 wrote to memory of 956 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe cmd.exe PID 1344 wrote to memory of 956 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe cmd.exe PID 1344 wrote to memory of 956 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe cmd.exe PID 1344 wrote to memory of 956 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe cmd.exe PID 1344 wrote to memory of 1016 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 1016 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 1016 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 1016 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 588 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 588 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 588 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 588 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 544 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 544 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 544 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 544 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe sc.exe PID 1344 wrote to memory of 1548 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe netsh.exe PID 1344 wrote to memory of 1548 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe netsh.exe PID 1344 wrote to memory of 1548 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe netsh.exe PID 1344 wrote to memory of 1548 1344 36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe netsh.exe PID 1968 wrote to memory of 1252 1968 zbwneyfy.exe svchost.exe PID 1968 wrote to memory of 1252 1968 zbwneyfy.exe svchost.exe PID 1968 wrote to memory of 1252 1968 zbwneyfy.exe svchost.exe PID 1968 wrote to memory of 1252 1968 zbwneyfy.exe svchost.exe PID 1968 wrote to memory of 1252 1968 zbwneyfy.exe svchost.exe PID 1968 wrote to memory of 1252 1968 zbwneyfy.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe"C:\Users\Admin\AppData\Local\Temp\36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bkbmtzds\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zbwneyfy.exe" C:\Windows\SysWOW64\bkbmtzds\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create bkbmtzds binPath= "C:\Windows\SysWOW64\bkbmtzds\zbwneyfy.exe /d\"C:\Users\Admin\AppData\Local\Temp\36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description bkbmtzds "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start bkbmtzds2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\bkbmtzds\zbwneyfy.exeC:\Windows\SysWOW64\bkbmtzds\zbwneyfy.exe /d"C:\Users\Admin\AppData\Local\Temp\36dd37703b6b84eb31184299be5935fd79e46b4c7b9a3f7c2bbdd73a9bedb701.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\zbwneyfy.exeFilesize
13.2MB
MD5ae7f9d39ec2151c89f32230617f551bd
SHA1b64500a31cc7c2926dd2a8a148189688e264c950
SHA256686c349e04a669c336298cd7eb69cc242ff459a6806eecad87c3a8fbbbac0b37
SHA512da3129d4b8117e45e83adfdd6c4948f5301cabaf253926c89b557c0013e00f9ef3872846da3b55d49eee7cf596d404807c0692a7aaed545521d35a4397197d37
-
C:\Windows\SysWOW64\bkbmtzds\zbwneyfy.exeFilesize
13.2MB
MD5ae7f9d39ec2151c89f32230617f551bd
SHA1b64500a31cc7c2926dd2a8a148189688e264c950
SHA256686c349e04a669c336298cd7eb69cc242ff459a6806eecad87c3a8fbbbac0b37
SHA512da3129d4b8117e45e83adfdd6c4948f5301cabaf253926c89b557c0013e00f9ef3872846da3b55d49eee7cf596d404807c0692a7aaed545521d35a4397197d37
-
memory/544-63-0x0000000000000000-mapping.dmp
-
memory/588-62-0x0000000000000000-mapping.dmp
-
memory/628-58-0x0000000000000000-mapping.dmp
-
memory/956-59-0x0000000000000000-mapping.dmp
-
memory/1016-61-0x0000000000000000-mapping.dmp
-
memory/1252-70-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1252-72-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1252-73-0x0000000000089A6B-mapping.dmp
-
memory/1252-78-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1252-80-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1344-57-0x0000000076171000-0x0000000076173000-memory.dmpFilesize
8KB
-
memory/1344-56-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1344-65-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1344-55-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1344-54-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1548-64-0x0000000000000000-mapping.dmp
-
memory/1968-67-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1968-74-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB