Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 02:43
Static task
static1
Behavioral task
behavioral1
Sample
568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe
Resource
win10v2004-20220721-en
General
-
Target
568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe
-
Size
142KB
-
MD5
048725634c77ed7223cd9b91d90b172b
-
SHA1
40628d5ffe1bbd7915a628938a8acac0d9c77ba3
-
SHA256
568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51
-
SHA512
ad87648a4003832c7ec6129b2745c119c693f99628295cb318d285b8c5ca23d8ec0a4682fdbe3e8a880de0f6e9b84ed78ae3279c457477d5d6a2b27f1284446c
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ykswszp = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
vrnzodki.exepid process 268 vrnzodki.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ykswszp\ImagePath = "C:\\Windows\\SysWOW64\\ykswszp\\vrnzodki.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 848 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
vrnzodki.exedescription pid process target process PID 268 set thread context of 848 268 vrnzodki.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1248 sc.exe 1892 sc.exe 936 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exevrnzodki.exedescription pid process target process PID 1812 wrote to memory of 1416 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe cmd.exe PID 1812 wrote to memory of 1416 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe cmd.exe PID 1812 wrote to memory of 1416 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe cmd.exe PID 1812 wrote to memory of 1416 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe cmd.exe PID 1812 wrote to memory of 868 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe cmd.exe PID 1812 wrote to memory of 868 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe cmd.exe PID 1812 wrote to memory of 868 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe cmd.exe PID 1812 wrote to memory of 868 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe cmd.exe PID 1812 wrote to memory of 1892 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 1892 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 1892 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 1892 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 936 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 936 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 936 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 936 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 1248 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 1248 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 1248 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 1248 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe sc.exe PID 1812 wrote to memory of 1728 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe netsh.exe PID 1812 wrote to memory of 1728 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe netsh.exe PID 1812 wrote to memory of 1728 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe netsh.exe PID 1812 wrote to memory of 1728 1812 568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe netsh.exe PID 268 wrote to memory of 848 268 vrnzodki.exe svchost.exe PID 268 wrote to memory of 848 268 vrnzodki.exe svchost.exe PID 268 wrote to memory of 848 268 vrnzodki.exe svchost.exe PID 268 wrote to memory of 848 268 vrnzodki.exe svchost.exe PID 268 wrote to memory of 848 268 vrnzodki.exe svchost.exe PID 268 wrote to memory of 848 268 vrnzodki.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe"C:\Users\Admin\AppData\Local\Temp\568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ykswszp\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\vrnzodki.exe" C:\Windows\SysWOW64\ykswszp\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ykswszp binPath= "C:\Windows\SysWOW64\ykswszp\vrnzodki.exe /d\"C:\Users\Admin\AppData\Local\Temp\568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ykswszp "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ykswszp2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\ykswszp\vrnzodki.exeC:\Windows\SysWOW64\ykswszp\vrnzodki.exe /d"C:\Users\Admin\AppData\Local\Temp\568bdd6fb9671d0f9cd3d2843d20aca0cae45ec57fff154b0b0c439af8f00b51.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\vrnzodki.exeFilesize
11.7MB
MD50ca9d91064f4572b23aeb25ccbc41366
SHA1a64952847753a58996350262b57e6bd5c66cb9d2
SHA256b45adbd95fdcca3135364ad921cd49e4ef77d2080551ecda0de7aaefbd0a1992
SHA512f174cbfd2329d3e9d2d9b2a81f03c798956394c28d3dda3c93048875940c4156d066bdefbc3cdac51a37b4257e766244bb52d909a9ff3f9f7e688a7e159c8d89
-
C:\Windows\SysWOW64\ykswszp\vrnzodki.exeFilesize
11.7MB
MD50ca9d91064f4572b23aeb25ccbc41366
SHA1a64952847753a58996350262b57e6bd5c66cb9d2
SHA256b45adbd95fdcca3135364ad921cd49e4ef77d2080551ecda0de7aaefbd0a1992
SHA512f174cbfd2329d3e9d2d9b2a81f03c798956394c28d3dda3c93048875940c4156d066bdefbc3cdac51a37b4257e766244bb52d909a9ff3f9f7e688a7e159c8d89
-
memory/268-65-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/848-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/848-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/848-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/848-70-0x0000000000089A6B-mapping.dmp
-
memory/848-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/868-57-0x0000000000000000-mapping.dmp
-
memory/936-60-0x0000000000000000-mapping.dmp
-
memory/1248-61-0x0000000000000000-mapping.dmp
-
memory/1416-56-0x0000000000000000-mapping.dmp
-
memory/1728-63-0x0000000000000000-mapping.dmp
-
memory/1812-54-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1812-55-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/1892-59-0x0000000000000000-mapping.dmp