Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
27-06-2022 00:07
Static task
static1
Behavioral task
behavioral1
Sample
3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe
Resource
win10v2004-20220414-en
General
-
Target
3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe
-
Size
104KB
-
MD5
67260c5c5215244985a54f8c8092bc8d
-
SHA1
5d8c9edaee2219781a8488f21fdb1e193b8dc8a6
-
SHA256
3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455
-
SHA512
f31c7f275b42366eed39d5517be6a406645929c92bc6a471a1ebbc83ed1318c0c23982dca33b3351fd2088a335b213ef3db45fa6ba025c00b13a5427ae13e2df
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\fiqkthbe = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
jqddgrje.exepid process 1832 jqddgrje.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\fiqkthbe\ImagePath = "C:\\Windows\\SysWOW64\\fiqkthbe\\jqddgrje.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1128 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
jqddgrje.exedescription pid process target process PID 1832 set thread context of 1128 1832 jqddgrje.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1116 sc.exe 2028 sc.exe 1324 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exejqddgrje.exedescription pid process target process PID 1672 wrote to memory of 876 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe cmd.exe PID 1672 wrote to memory of 876 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe cmd.exe PID 1672 wrote to memory of 876 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe cmd.exe PID 1672 wrote to memory of 876 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe cmd.exe PID 1672 wrote to memory of 964 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe cmd.exe PID 1672 wrote to memory of 964 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe cmd.exe PID 1672 wrote to memory of 964 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe cmd.exe PID 1672 wrote to memory of 964 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe cmd.exe PID 1672 wrote to memory of 1324 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 1324 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 1324 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 1324 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 1116 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 1116 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 1116 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 1116 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 2028 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 2028 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 2028 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 2028 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe sc.exe PID 1672 wrote to memory of 2008 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe netsh.exe PID 1672 wrote to memory of 2008 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe netsh.exe PID 1672 wrote to memory of 2008 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe netsh.exe PID 1672 wrote to memory of 2008 1672 3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe netsh.exe PID 1832 wrote to memory of 1128 1832 jqddgrje.exe svchost.exe PID 1832 wrote to memory of 1128 1832 jqddgrje.exe svchost.exe PID 1832 wrote to memory of 1128 1832 jqddgrje.exe svchost.exe PID 1832 wrote to memory of 1128 1832 jqddgrje.exe svchost.exe PID 1832 wrote to memory of 1128 1832 jqddgrje.exe svchost.exe PID 1832 wrote to memory of 1128 1832 jqddgrje.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe"C:\Users\Admin\AppData\Local\Temp\3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fiqkthbe\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jqddgrje.exe" C:\Windows\SysWOW64\fiqkthbe\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create fiqkthbe binPath= "C:\Windows\SysWOW64\fiqkthbe\jqddgrje.exe /d\"C:\Users\Admin\AppData\Local\Temp\3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description fiqkthbe "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start fiqkthbe2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\fiqkthbe\jqddgrje.exeC:\Windows\SysWOW64\fiqkthbe\jqddgrje.exe /d"C:\Users\Admin\AppData\Local\Temp\3576d8e57c835f522ebaa917700dbabecc817dcdc7b4d21d2b155e7fe4977455.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jqddgrje.exeFilesize
14.2MB
MD5547018a92c5d07ddef84793620563f8d
SHA16818c15a06bc1854bea3546237959d46ecef795a
SHA256b199486bb23dde88b1768cd2df95a8db1a57bc505715a8c2239e1f81c5b96f1d
SHA512f8535f014bd1e0aaa5f6314d86e72ab57155d09e80612022485fab757b91efc881079f64341345afe3a285e64a1fc868601125a9b33b46eb7af4d4d8eebc7419
-
C:\Windows\SysWOW64\fiqkthbe\jqddgrje.exeFilesize
14.2MB
MD5547018a92c5d07ddef84793620563f8d
SHA16818c15a06bc1854bea3546237959d46ecef795a
SHA256b199486bb23dde88b1768cd2df95a8db1a57bc505715a8c2239e1f81c5b96f1d
SHA512f8535f014bd1e0aaa5f6314d86e72ab57155d09e80612022485fab757b91efc881079f64341345afe3a285e64a1fc868601125a9b33b46eb7af4d4d8eebc7419
-
memory/876-56-0x0000000000000000-mapping.dmp
-
memory/964-57-0x0000000000000000-mapping.dmp
-
memory/1116-60-0x0000000000000000-mapping.dmp
-
memory/1128-66-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1128-68-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1128-69-0x0000000000089A6B-mapping.dmp
-
memory/1128-72-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1128-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1128-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1324-59-0x0000000000000000-mapping.dmp
-
memory/1672-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1672-54-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1832-63-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2008-65-0x0000000000000000-mapping.dmp
-
memory/2028-61-0x0000000000000000-mapping.dmp