Analysis
-
max time kernel
138s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
30-07-2022 20:00
Static task
static1
Behavioral task
behavioral1
Sample
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe
Resource
win10v2004-20220721-en
General
-
Target
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe
-
Size
139KB
-
MD5
59716c29133bdaf34175ab183a1a7e3c
-
SHA1
e265094493c86a5a5a2596563cb9c47c592ec599
-
SHA256
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334
-
SHA512
68b05b8a8ca0c40a395de19ed8792c59641155f69e0a9704505a016872de88c5c7f6784f54b0740f0ffb3668bcf85bb263cfc59f7dcdcc50c73444a18976b3eb
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
caoabwua.exepid process 548 caoabwua.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\cyrxspkx\ImagePath = "C:\\Windows\\SysWOW64\\cyrxspkx\\caoabwua.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 692 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
caoabwua.exedescription pid process target process PID 548 set thread context of 692 548 caoabwua.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 908 sc.exe 1036 sc.exe 1500 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.execaoabwua.exedescription pid process target process PID 272 wrote to memory of 1424 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe cmd.exe PID 272 wrote to memory of 1424 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe cmd.exe PID 272 wrote to memory of 1424 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe cmd.exe PID 272 wrote to memory of 1424 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe cmd.exe PID 272 wrote to memory of 1292 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe cmd.exe PID 272 wrote to memory of 1292 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe cmd.exe PID 272 wrote to memory of 1292 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe cmd.exe PID 272 wrote to memory of 1292 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe cmd.exe PID 272 wrote to memory of 908 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 908 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 908 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 908 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 1036 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 1036 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 1036 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 1036 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 1500 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 1500 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 1500 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 1500 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe sc.exe PID 272 wrote to memory of 988 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe netsh.exe PID 272 wrote to memory of 988 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe netsh.exe PID 272 wrote to memory of 988 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe netsh.exe PID 272 wrote to memory of 988 272 61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe netsh.exe PID 548 wrote to memory of 692 548 caoabwua.exe svchost.exe PID 548 wrote to memory of 692 548 caoabwua.exe svchost.exe PID 548 wrote to memory of 692 548 caoabwua.exe svchost.exe PID 548 wrote to memory of 692 548 caoabwua.exe svchost.exe PID 548 wrote to memory of 692 548 caoabwua.exe svchost.exe PID 548 wrote to memory of 692 548 caoabwua.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe"C:\Users\Admin\AppData\Local\Temp\61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cyrxspkx\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\caoabwua.exe" C:\Windows\SysWOW64\cyrxspkx\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create cyrxspkx binPath= "C:\Windows\SysWOW64\cyrxspkx\caoabwua.exe /d\"C:\Users\Admin\AppData\Local\Temp\61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description cyrxspkx "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start cyrxspkx2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\cyrxspkx\caoabwua.exeC:\Windows\SysWOW64\cyrxspkx\caoabwua.exe /d"C:\Users\Admin\AppData\Local\Temp\61d06bf851691930e040bb472f567fa64a973936bd43fe325096e33b4bc48334.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\caoabwua.exeFilesize
11.3MB
MD50af183b5374863285d46fbcf2a5949ae
SHA1695e80cb1d7d8ff29dd6aeda10e0ffe144ff8792
SHA2569214c60a714dad619bee94cd218eb64c9571e407ffbf2bea6df6a6948c11e858
SHA512fc4c14fe3dd70fa6237d72f294da34513ea08323b72ae95f2f29970d43b43d0ccb83acc0124571a69c8d9da105cebd39081b55d2194fb3cf14672978bf221117
-
C:\Windows\SysWOW64\cyrxspkx\caoabwua.exeFilesize
11.3MB
MD50af183b5374863285d46fbcf2a5949ae
SHA1695e80cb1d7d8ff29dd6aeda10e0ffe144ff8792
SHA2569214c60a714dad619bee94cd218eb64c9571e407ffbf2bea6df6a6948c11e858
SHA512fc4c14fe3dd70fa6237d72f294da34513ea08323b72ae95f2f29970d43b43d0ccb83acc0124571a69c8d9da105cebd39081b55d2194fb3cf14672978bf221117
-
memory/272-55-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB
-
memory/272-54-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/548-65-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/692-69-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/692-75-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/692-74-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/692-73-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/692-70-0x00000000000C9A6B-mapping.dmp
-
memory/692-67-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/908-59-0x0000000000000000-mapping.dmp
-
memory/988-63-0x0000000000000000-mapping.dmp
-
memory/1036-60-0x0000000000000000-mapping.dmp
-
memory/1292-57-0x0000000000000000-mapping.dmp
-
memory/1424-56-0x0000000000000000-mapping.dmp
-
memory/1500-61-0x0000000000000000-mapping.dmp