Analysis
-
max time kernel
142s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
26-07-2022 18:39
Static task
static1
Behavioral task
behavioral1
Sample
53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe
Resource
win10v2004-20220721-en
General
-
Target
53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe
-
Size
98KB
-
MD5
d9edc460194b4e171f4d802203dba4d4
-
SHA1
6ff3775eae4005c8c6684f7520ccccf747985836
-
SHA256
53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593
-
SHA512
f6d648c86d4ecfb9c18b8fee28706b3ca01f74bb623c35ae295b7196b7eba3d2db896960dacfb6b6e4626f8198480b429e71a2d05e4ca7ba0bce7bcd4b8d57dd
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\vkxwdfms = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
dfaricjc.exepid process 1572 dfaricjc.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\vkxwdfms\ImagePath = "C:\\Windows\\SysWOW64\\vkxwdfms\\dfaricjc.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1868 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
dfaricjc.exedescription pid process target process PID 1572 set thread context of 1868 1572 dfaricjc.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1744 sc.exe 880 sc.exe 1164 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exedfaricjc.exedescription pid process target process PID 1984 wrote to memory of 1748 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe cmd.exe PID 1984 wrote to memory of 1748 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe cmd.exe PID 1984 wrote to memory of 1748 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe cmd.exe PID 1984 wrote to memory of 1748 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe cmd.exe PID 1984 wrote to memory of 1464 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe cmd.exe PID 1984 wrote to memory of 1464 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe cmd.exe PID 1984 wrote to memory of 1464 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe cmd.exe PID 1984 wrote to memory of 1464 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe cmd.exe PID 1984 wrote to memory of 1744 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 1744 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 1744 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 1744 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 880 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 880 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 880 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 880 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 1164 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 1164 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 1164 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 1164 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe sc.exe PID 1984 wrote to memory of 340 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe netsh.exe PID 1984 wrote to memory of 340 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe netsh.exe PID 1984 wrote to memory of 340 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe netsh.exe PID 1984 wrote to memory of 340 1984 53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe netsh.exe PID 1572 wrote to memory of 1868 1572 dfaricjc.exe svchost.exe PID 1572 wrote to memory of 1868 1572 dfaricjc.exe svchost.exe PID 1572 wrote to memory of 1868 1572 dfaricjc.exe svchost.exe PID 1572 wrote to memory of 1868 1572 dfaricjc.exe svchost.exe PID 1572 wrote to memory of 1868 1572 dfaricjc.exe svchost.exe PID 1572 wrote to memory of 1868 1572 dfaricjc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe"C:\Users\Admin\AppData\Local\Temp\53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\vkxwdfms\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dfaricjc.exe" C:\Windows\SysWOW64\vkxwdfms\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create vkxwdfms binPath= "C:\Windows\SysWOW64\vkxwdfms\dfaricjc.exe /d\"C:\Users\Admin\AppData\Local\Temp\53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description vkxwdfms "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start vkxwdfms2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\vkxwdfms\dfaricjc.exeC:\Windows\SysWOW64\vkxwdfms\dfaricjc.exe /d"C:\Users\Admin\AppData\Local\Temp\53e637996db3df92d3ef579b52fc63f38902c2d9522295ef07bbb3594cad2593.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\dfaricjc.exeFilesize
14.3MB
MD56d3f0ac5095411d37d9bed526c6d749e
SHA1e6d26c3eb92fa684581a190fe7f69a9391067c62
SHA25627b80aa45bcb7b0348dd3e62c7eb09995e0def1cb116be28c4b570386902923a
SHA512ef1b9addcc4221147144ea58f14b7ac1e5b812360864780dc265164af0472f5987d66c7cf2bb858acf0939e057b20fb7b7dc9e42f23ea85789eaced81bdc63c2
-
C:\Windows\SysWOW64\vkxwdfms\dfaricjc.exeFilesize
14.3MB
MD56d3f0ac5095411d37d9bed526c6d749e
SHA1e6d26c3eb92fa684581a190fe7f69a9391067c62
SHA25627b80aa45bcb7b0348dd3e62c7eb09995e0def1cb116be28c4b570386902923a
SHA512ef1b9addcc4221147144ea58f14b7ac1e5b812360864780dc265164af0472f5987d66c7cf2bb858acf0939e057b20fb7b7dc9e42f23ea85789eaced81bdc63c2
-
memory/340-62-0x0000000000000000-mapping.dmp
-
memory/880-60-0x0000000000000000-mapping.dmp
-
memory/1164-61-0x0000000000000000-mapping.dmp
-
memory/1464-57-0x0000000000000000-mapping.dmp
-
memory/1572-64-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1744-59-0x0000000000000000-mapping.dmp
-
memory/1748-56-0x0000000000000000-mapping.dmp
-
memory/1868-66-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1868-68-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1868-69-0x0000000000089A6B-mapping.dmp
-
memory/1868-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1868-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1984-54-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1984-55-0x0000000075441000-0x0000000075443000-memory.dmpFilesize
8KB