Analysis
-
max time kernel
130s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 01:33
Static task
static1
Behavioral task
behavioral1
Sample
3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe
Resource
win10v2004-20220414-en
General
-
Target
3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe
-
Size
262KB
-
MD5
f0a0aad635dfaf849e931d305893f282
-
SHA1
1501b1f501b1ba2d3b42555f8292e32bd9c00268
-
SHA256
3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc
-
SHA512
26f7773e81fdd30fd86cac6b6ded11333f1f95cc1a7d8301d535a1ead16cda38368c96a5fee0fa927197118458a57b442ddf446ce7fe0f1531f3c3b50e2ac96f
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
qxkknyql.exepid process 3672 qxkknyql.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 4224 sc.exe 5052 sc.exe 540 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1596 400 WerFault.exe 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exedescription pid process target process PID 400 wrote to memory of 3896 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe cmd.exe PID 400 wrote to memory of 3896 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe cmd.exe PID 400 wrote to memory of 3896 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe cmd.exe PID 400 wrote to memory of 3436 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe cmd.exe PID 400 wrote to memory of 3436 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe cmd.exe PID 400 wrote to memory of 3436 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe cmd.exe PID 400 wrote to memory of 4224 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe sc.exe PID 400 wrote to memory of 4224 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe sc.exe PID 400 wrote to memory of 4224 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe sc.exe PID 400 wrote to memory of 5052 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe sc.exe PID 400 wrote to memory of 5052 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe sc.exe PID 400 wrote to memory of 5052 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe sc.exe PID 400 wrote to memory of 540 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe sc.exe PID 400 wrote to memory of 540 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe sc.exe PID 400 wrote to memory of 540 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe sc.exe PID 400 wrote to memory of 4232 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe netsh.exe PID 400 wrote to memory of 4232 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe netsh.exe PID 400 wrote to memory of 4232 400 3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe"C:\Users\Admin\AppData\Local\Temp\3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tgexgvy\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qxkknyql.exe" C:\Windows\SysWOW64\tgexgvy\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create tgexgvy binPath= "C:\Windows\SysWOW64\tgexgvy\qxkknyql.exe /d\"C:\Users\Admin\AppData\Local\Temp\3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description tgexgvy "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start tgexgvy2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 10322⤵
- Program crash
-
C:\Windows\SysWOW64\tgexgvy\qxkknyql.exeC:\Windows\SysWOW64\tgexgvy\qxkknyql.exe /d"C:\Users\Admin\AppData\Local\Temp\3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 400 -ip 4001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qxkknyql.exeFilesize
11.7MB
MD533a7b2ccedabe4fbaed974b4f40a6146
SHA1398f77ed3b572f43705f86680f3feb808b6fd8a7
SHA256aea023f37cb6b3a440eb144cb05209e8e042a0574d99bd3fba5294a506352caf
SHA51285354b29fcc49ed36d85a48b296fbf358dca87751f2386574b898422492ddacbfe012facdc5a6ae0efa2845e087961ef83fd8908d13163063bf6b20fe703812a
-
C:\Windows\SysWOW64\tgexgvy\qxkknyql.exeFilesize
11.7MB
MD533a7b2ccedabe4fbaed974b4f40a6146
SHA1398f77ed3b572f43705f86680f3feb808b6fd8a7
SHA256aea023f37cb6b3a440eb144cb05209e8e042a0574d99bd3fba5294a506352caf
SHA51285354b29fcc49ed36d85a48b296fbf358dca87751f2386574b898422492ddacbfe012facdc5a6ae0efa2845e087961ef83fd8908d13163063bf6b20fe703812a
-
memory/400-130-0x00000000006CD000-0x00000000006DD000-memory.dmpFilesize
64KB
-
memory/400-131-0x00000000006CD000-0x00000000006DD000-memory.dmpFilesize
64KB
-
memory/400-132-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/400-141-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/540-138-0x0000000000000000-mapping.dmp
-
memory/3436-134-0x0000000000000000-mapping.dmp
-
memory/3896-133-0x0000000000000000-mapping.dmp
-
memory/4224-136-0x0000000000000000-mapping.dmp
-
memory/4232-140-0x0000000000000000-mapping.dmp
-
memory/5052-137-0x0000000000000000-mapping.dmp