Analysis
-
max time kernel
321s -
max time network
1772s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 19:46
Static task
static1
Behavioral task
behavioral1
Sample
fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe
Resource
win10v2004-20220414-en
General
-
Target
fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe
-
Size
11.0MB
-
MD5
734c2faea43e5b51f8261cd2873bb940
-
SHA1
3bb1bf5d3658bd1975fa35859d1ba35641735097
-
SHA256
fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d
-
SHA512
b77d4b10a09db22cb01f40fb1268ab05a335be58f6848b5978adfe25a8042ee73a9b1279aaffcbce24ba47232344c074787581b9bf47d09a70906dd55fcd173b
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\klvnttvh = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
dvemjwic.exepid process 436 dvemjwic.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\klvnttvh\ImagePath = "C:\\Windows\\SysWOW64\\klvnttvh\\dvemjwic.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 772 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dvemjwic.exedescription pid process target process PID 436 set thread context of 772 436 dvemjwic.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 320 sc.exe 1136 sc.exe 528 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exedvemjwic.exedescription pid process target process PID 1720 wrote to memory of 1468 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe cmd.exe PID 1720 wrote to memory of 1468 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe cmd.exe PID 1720 wrote to memory of 1468 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe cmd.exe PID 1720 wrote to memory of 1468 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe cmd.exe PID 1720 wrote to memory of 1404 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe cmd.exe PID 1720 wrote to memory of 1404 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe cmd.exe PID 1720 wrote to memory of 1404 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe cmd.exe PID 1720 wrote to memory of 1404 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe cmd.exe PID 1720 wrote to memory of 1136 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 1136 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 1136 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 1136 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 528 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 528 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 528 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 528 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 320 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 320 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 320 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 320 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe sc.exe PID 1720 wrote to memory of 820 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe netsh.exe PID 1720 wrote to memory of 820 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe netsh.exe PID 1720 wrote to memory of 820 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe netsh.exe PID 1720 wrote to memory of 820 1720 fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe netsh.exe PID 436 wrote to memory of 772 436 dvemjwic.exe svchost.exe PID 436 wrote to memory of 772 436 dvemjwic.exe svchost.exe PID 436 wrote to memory of 772 436 dvemjwic.exe svchost.exe PID 436 wrote to memory of 772 436 dvemjwic.exe svchost.exe PID 436 wrote to memory of 772 436 dvemjwic.exe svchost.exe PID 436 wrote to memory of 772 436 dvemjwic.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe"C:\Users\Admin\AppData\Local\Temp\fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\klvnttvh\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dvemjwic.exe" C:\Windows\SysWOW64\klvnttvh\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create klvnttvh binPath= "C:\Windows\SysWOW64\klvnttvh\dvemjwic.exe /d\"C:\Users\Admin\AppData\Local\Temp\fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description klvnttvh "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start klvnttvh2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\klvnttvh\dvemjwic.exeC:\Windows\SysWOW64\klvnttvh\dvemjwic.exe /d"C:\Users\Admin\AppData\Local\Temp\fe70a88244756a21fa321b27001ea72d524003de90356fa9797ce218c794ff5d.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dvemjwic.exeFilesize
249KB
MD5c27a7cc7182dd6b97b3c89525f1a3493
SHA162812fdba1547197a101522442fa708f1ce97e02
SHA2563d55d4ccf4503394eb1f2f856fedcdd74816ec41febe22c4ffa55c445ec446e5
SHA51252b66a8751cd1514d9e3b585a882f9077ba992f93d70d5a82264e2e5b290ed7e71e2f58206d63e53c92992d7d390f011414a7896a97cbb87feb05f12fc61fc76
-
C:\Windows\SysWOW64\klvnttvh\dvemjwic.exeFilesize
454KB
MD5394f2344f46ef7fe4cdbdbd40fe8657e
SHA10b3c73b06a48f54e3ba670281760de0888cf11fa
SHA256628727d6a0791935fe6a742aaaede0da2e369435c69d23e48a905cdefd81232a
SHA51248f0fbb7887a1b84768c522c9b2a7519f0499c3ff2fed052cf433a9b6319e2db8f4635e49501ffd916aba8e66d9026986f462add048f01f5a66a6af0d4c8aa4e
-
memory/320-64-0x0000000000000000-mapping.dmp
-
memory/436-71-0x0000000000400000-0x0000000002C68000-memory.dmpFilesize
40.4MB
-
memory/436-70-0x0000000002E0B000-0x0000000002E19000-memory.dmpFilesize
56KB
-
memory/436-80-0x0000000000400000-0x0000000002C68000-memory.dmpFilesize
40.4MB
-
memory/436-79-0x0000000002E0B000-0x0000000002E19000-memory.dmpFilesize
56KB
-
memory/528-63-0x0000000000000000-mapping.dmp
-
memory/772-82-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/772-81-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/772-72-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/772-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/772-75-0x0000000000089A6B-mapping.dmp
-
memory/820-66-0x0000000000000000-mapping.dmp
-
memory/1136-62-0x0000000000000000-mapping.dmp
-
memory/1404-60-0x0000000000000000-mapping.dmp
-
memory/1468-57-0x0000000000000000-mapping.dmp
-
memory/1720-59-0x0000000000400000-0x0000000002C68000-memory.dmpFilesize
40.4MB
-
memory/1720-58-0x00000000003A0000-0x00000000003B3000-memory.dmpFilesize
76KB
-
memory/1720-56-0x0000000000230000-0x0000000000330000-memory.dmpFilesize
1024KB
-
memory/1720-55-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/1720-67-0x0000000000400000-0x0000000002C68000-memory.dmpFilesize
40.4MB