Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 09:04
Static task
static1
Behavioral task
behavioral1
Sample
3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe
Resource
win10v2004-20220414-en
General
-
Target
3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe
-
Size
104KB
-
MD5
cfce7e045cb6ed8bdcab5460ea2ff37a
-
SHA1
6bdc0c47643df5da4a583b0e23a8572a90d27ecd
-
SHA256
3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed
-
SHA512
41d25210921915a7163daa4433a61f8c865a64829fa1d1ffd50a2dea7aa8aef66d3e7ed52229bac9e181c20b21543a3cb92251edcdce738e1735010bdba01279
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\txwqypzj = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
poawblvi.exepid process 268 poawblvi.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\txwqypzj\ImagePath = "C:\\Windows\\SysWOW64\\txwqypzj\\poawblvi.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1468 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
poawblvi.exedescription pid process target process PID 268 set thread context of 1468 268 poawblvi.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1048 sc.exe 1732 sc.exe 612 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exepoawblvi.exedescription pid process target process PID 1672 wrote to memory of 896 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe cmd.exe PID 1672 wrote to memory of 896 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe cmd.exe PID 1672 wrote to memory of 896 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe cmd.exe PID 1672 wrote to memory of 896 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe cmd.exe PID 1672 wrote to memory of 940 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe cmd.exe PID 1672 wrote to memory of 940 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe cmd.exe PID 1672 wrote to memory of 940 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe cmd.exe PID 1672 wrote to memory of 940 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe cmd.exe PID 1672 wrote to memory of 1048 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 1048 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 1048 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 1048 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 1732 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 1732 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 1732 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 1732 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 612 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 612 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 612 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 612 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe sc.exe PID 1672 wrote to memory of 664 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe netsh.exe PID 1672 wrote to memory of 664 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe netsh.exe PID 1672 wrote to memory of 664 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe netsh.exe PID 1672 wrote to memory of 664 1672 3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe netsh.exe PID 268 wrote to memory of 1468 268 poawblvi.exe svchost.exe PID 268 wrote to memory of 1468 268 poawblvi.exe svchost.exe PID 268 wrote to memory of 1468 268 poawblvi.exe svchost.exe PID 268 wrote to memory of 1468 268 poawblvi.exe svchost.exe PID 268 wrote to memory of 1468 268 poawblvi.exe svchost.exe PID 268 wrote to memory of 1468 268 poawblvi.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe"C:\Users\Admin\AppData\Local\Temp\3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\txwqypzj\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\poawblvi.exe" C:\Windows\SysWOW64\txwqypzj\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create txwqypzj binPath= "C:\Windows\SysWOW64\txwqypzj\poawblvi.exe /d\"C:\Users\Admin\AppData\Local\Temp\3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description txwqypzj "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start txwqypzj2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\txwqypzj\poawblvi.exeC:\Windows\SysWOW64\txwqypzj\poawblvi.exe /d"C:\Users\Admin\AppData\Local\Temp\3bf66140ed49d2b71c6674e064b26d605f196ec45b99cc2392802313918cd4ed.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\poawblvi.exeFilesize
10.1MB
MD5712afd502817dec16fb46ead0097406f
SHA1178aa7a83e64d4944277081944df0a67758dbaa0
SHA2563ddb26436b0a480066d96180264867eb436ba6c0cababbc706613d64658632cb
SHA5127324cac97e916ef07441d5434f487080d110fd04387eab63ab72c15de6b5b40d83f753244ef8a1c450b7abb89ffb5e57d460439ac3b78c008b998c47c564a910
-
C:\Windows\SysWOW64\txwqypzj\poawblvi.exeFilesize
10.1MB
MD5712afd502817dec16fb46ead0097406f
SHA1178aa7a83e64d4944277081944df0a67758dbaa0
SHA2563ddb26436b0a480066d96180264867eb436ba6c0cababbc706613d64658632cb
SHA5127324cac97e916ef07441d5434f487080d110fd04387eab63ab72c15de6b5b40d83f753244ef8a1c450b7abb89ffb5e57d460439ac3b78c008b998c47c564a910
-
memory/268-63-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/612-61-0x0000000000000000-mapping.dmp
-
memory/664-65-0x0000000000000000-mapping.dmp
-
memory/896-56-0x0000000000000000-mapping.dmp
-
memory/940-57-0x0000000000000000-mapping.dmp
-
memory/1048-59-0x0000000000000000-mapping.dmp
-
memory/1468-66-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1468-68-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1468-69-0x0000000000089A6B-mapping.dmp
-
memory/1468-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1468-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1672-54-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1672-55-0x0000000075B61000-0x0000000075B63000-memory.dmpFilesize
8KB
-
memory/1732-60-0x0000000000000000-mapping.dmp