Analysis
-
max time kernel
185s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 01:27
Static task
static1
Behavioral task
behavioral1
Sample
3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe
Resource
win10v2004-20220414-en
General
-
Target
3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe
-
Size
137KB
-
MD5
708dc91ee0b8a61718e9991a1396b23f
-
SHA1
d7bd310fd1a8ba9500c00b4e7626aa780552d26c
-
SHA256
3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917
-
SHA512
569e90713153b268f2cdcb12e78156facdcda6e936ae45e0032d317efe9d8d442d53335ab7e37514cb800d9885d5c575209b2a64e098e69c4c4db20f927f7278
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
qnykefj.exepid process 540 qnykefj.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\mhfknafi\ImagePath = "C:\\Windows\\SysWOW64\\mhfknafi\\qnykefj.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1168 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
qnykefj.exedescription pid process target process PID 540 set thread context of 1168 540 qnykefj.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 772 sc.exe 1884 sc.exe 696 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exeqnykefj.exedescription pid process target process PID 1648 wrote to memory of 2016 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe cmd.exe PID 1648 wrote to memory of 2016 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe cmd.exe PID 1648 wrote to memory of 2016 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe cmd.exe PID 1648 wrote to memory of 2016 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe cmd.exe PID 1648 wrote to memory of 1344 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe cmd.exe PID 1648 wrote to memory of 1344 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe cmd.exe PID 1648 wrote to memory of 1344 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe cmd.exe PID 1648 wrote to memory of 1344 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe cmd.exe PID 1648 wrote to memory of 696 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 696 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 696 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 696 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 772 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 772 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 772 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 772 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 1884 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 1884 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 1884 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 1884 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe sc.exe PID 1648 wrote to memory of 1288 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe netsh.exe PID 1648 wrote to memory of 1288 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe netsh.exe PID 1648 wrote to memory of 1288 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe netsh.exe PID 1648 wrote to memory of 1288 1648 3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe netsh.exe PID 540 wrote to memory of 1168 540 qnykefj.exe svchost.exe PID 540 wrote to memory of 1168 540 qnykefj.exe svchost.exe PID 540 wrote to memory of 1168 540 qnykefj.exe svchost.exe PID 540 wrote to memory of 1168 540 qnykefj.exe svchost.exe PID 540 wrote to memory of 1168 540 qnykefj.exe svchost.exe PID 540 wrote to memory of 1168 540 qnykefj.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe"C:\Users\Admin\AppData\Local\Temp\3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mhfknafi\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qnykefj.exe" C:\Windows\SysWOW64\mhfknafi\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create mhfknafi binPath= "C:\Windows\SysWOW64\mhfknafi\qnykefj.exe /d\"C:\Users\Admin\AppData\Local\Temp\3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description mhfknafi "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start mhfknafi2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mhfknafi\qnykefj.exeC:\Windows\SysWOW64\mhfknafi\qnykefj.exe /d"C:\Users\Admin\AppData\Local\Temp\3f7bb036eef312a9c1fca60105f1b87235dc8b14d617e415f95a7043f9efe917.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qnykefj.exeFilesize
12.7MB
MD5f60c2bd49b345b3d9e23db75cb5b19f2
SHA1e29d3469ef25e8508813f7469c831877ce84403a
SHA25653df958a811eaa426e28a57976c9cd40bd2d5ea11cc94edeb0a9d28788847e9d
SHA512087019abd7a810fca5a7cb4f215091f59fe032dc34e01d129016ee09bf9da716299c854f89c25f52f06e6c1d251ed312e3f4d163a68ab3b82324de536052bbbb
-
C:\Windows\SysWOW64\mhfknafi\qnykefj.exeFilesize
12.7MB
MD5f60c2bd49b345b3d9e23db75cb5b19f2
SHA1e29d3469ef25e8508813f7469c831877ce84403a
SHA25653df958a811eaa426e28a57976c9cd40bd2d5ea11cc94edeb0a9d28788847e9d
SHA512087019abd7a810fca5a7cb4f215091f59fe032dc34e01d129016ee09bf9da716299c854f89c25f52f06e6c1d251ed312e3f4d163a68ab3b82324de536052bbbb
-
memory/540-65-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/696-58-0x0000000000000000-mapping.dmp
-
memory/772-59-0x0000000000000000-mapping.dmp
-
memory/1168-70-0x0000000000089A6B-mapping.dmp
-
memory/1168-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1168-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1168-73-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1168-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1168-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1288-62-0x0000000000000000-mapping.dmp
-
memory/1344-57-0x0000000000000000-mapping.dmp
-
memory/1648-55-0x0000000075761000-0x0000000075763000-memory.dmpFilesize
8KB
-
memory/1648-54-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1884-61-0x0000000000000000-mapping.dmp
-
memory/2016-56-0x0000000000000000-mapping.dmp