Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe
Resource
win10v2004-20220414-en
General
-
Target
3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe
-
Size
113KB
-
MD5
bb99840487a3b6cd641612b2d02cd14a
-
SHA1
6231dd81359dbc961b572ed5191756c0d8f910f9
-
SHA256
3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06
-
SHA512
ab420f39ef21cf0eebf395fe5506ef87ab02adab8f15366c9deecb17e5266ee88ade649e8cabc19d9538da579a2fec69983ae7e160fb48c35d21e95890112ce2
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\bvieabmz = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
jvwqlhif.exepid process 2036 jvwqlhif.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\bvieabmz\ImagePath = "C:\\Windows\\SysWOW64\\bvieabmz\\jvwqlhif.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1208 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
jvwqlhif.exedescription pid process target process PID 2036 set thread context of 1208 2036 jvwqlhif.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 588 sc.exe 1096 sc.exe 1720 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exejvwqlhif.exedescription pid process target process PID 1512 wrote to memory of 1980 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe cmd.exe PID 1512 wrote to memory of 1980 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe cmd.exe PID 1512 wrote to memory of 1980 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe cmd.exe PID 1512 wrote to memory of 1980 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe cmd.exe PID 1512 wrote to memory of 956 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe cmd.exe PID 1512 wrote to memory of 956 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe cmd.exe PID 1512 wrote to memory of 956 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe cmd.exe PID 1512 wrote to memory of 956 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe cmd.exe PID 1512 wrote to memory of 1096 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 1096 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 1096 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 1096 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 1720 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 1720 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 1720 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 1720 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 588 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 588 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 588 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 1512 wrote to memory of 588 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe sc.exe PID 2036 wrote to memory of 1208 2036 jvwqlhif.exe svchost.exe PID 2036 wrote to memory of 1208 2036 jvwqlhif.exe svchost.exe PID 2036 wrote to memory of 1208 2036 jvwqlhif.exe svchost.exe PID 2036 wrote to memory of 1208 2036 jvwqlhif.exe svchost.exe PID 2036 wrote to memory of 1208 2036 jvwqlhif.exe svchost.exe PID 2036 wrote to memory of 1208 2036 jvwqlhif.exe svchost.exe PID 1512 wrote to memory of 1652 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe netsh.exe PID 1512 wrote to memory of 1652 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe netsh.exe PID 1512 wrote to memory of 1652 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe netsh.exe PID 1512 wrote to memory of 1652 1512 3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe"C:\Users\Admin\AppData\Local\Temp\3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bvieabmz\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jvwqlhif.exe" C:\Windows\SysWOW64\bvieabmz\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create bvieabmz binPath= "C:\Windows\SysWOW64\bvieabmz\jvwqlhif.exe /d\"C:\Users\Admin\AppData\Local\Temp\3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description bvieabmz "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start bvieabmz2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\bvieabmz\jvwqlhif.exeC:\Windows\SysWOW64\bvieabmz\jvwqlhif.exe /d"C:\Users\Admin\AppData\Local\Temp\3d40e81224ca9620c592189da91429622a1493384561ab839bfb9c0ad3869e06.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jvwqlhif.exeFilesize
10.7MB
MD5e706594c92d70009b48318ccdfcae8b8
SHA14dd5f7f3c0d0a5a71586f874567d67a838521ccf
SHA256021e6fd6778706e3be21e9ab247724bdfa6d7c6aed86c28f701140f7eeb40981
SHA5120b9f02f9fbb046444f40c3fb041b3d96df4e0212852e1e8b73468b14a074e03b2d9a72c227d2a019c30fb9ee6d40546e147a0c8d1cdd3522e4533343ffa4f638
-
C:\Windows\SysWOW64\bvieabmz\jvwqlhif.exeFilesize
10.7MB
MD5e706594c92d70009b48318ccdfcae8b8
SHA14dd5f7f3c0d0a5a71586f874567d67a838521ccf
SHA256021e6fd6778706e3be21e9ab247724bdfa6d7c6aed86c28f701140f7eeb40981
SHA5120b9f02f9fbb046444f40c3fb041b3d96df4e0212852e1e8b73468b14a074e03b2d9a72c227d2a019c30fb9ee6d40546e147a0c8d1cdd3522e4533343ffa4f638
-
memory/588-62-0x0000000000000000-mapping.dmp
-
memory/956-58-0x0000000000000000-mapping.dmp
-
memory/1096-60-0x0000000000000000-mapping.dmp
-
memory/1208-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1208-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1208-79-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1208-78-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1208-70-0x0000000000089A6B-mapping.dmp
-
memory/1512-55-0x0000000076421000-0x0000000076423000-memory.dmpFilesize
8KB
-
memory/1512-57-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1512-54-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1512-76-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1652-75-0x0000000000000000-mapping.dmp
-
memory/1720-61-0x0000000000000000-mapping.dmp
-
memory/1980-56-0x0000000000000000-mapping.dmp
-
memory/2036-66-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2036-64-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2036-71-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB