Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
31-07-2022 21:49
Static task
static1
Behavioral task
behavioral1
Sample
5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe
Resource
win10v2004-20220721-en
General
-
Target
5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe
-
Size
312KB
-
MD5
239efbf95c2860f12e662a99b3565f48
-
SHA1
05c15510420333d3d737d7fe97e21d0c05ca081e
-
SHA256
5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3
-
SHA512
4b256ab638ab603aeffdcb952b08e593e05d09a2d0cf6f220afd8ab9750491ec8e8ae1371515a69fd6ad2e2633dce29848e9e00040e9e64e1300c62bc335aee3
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
ihtpueob.exepid process 456 ihtpueob.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dbwdahuc\ImagePath = "C:\\Windows\\SysWOW64\\dbwdahuc\\ihtpueob.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ihtpueob.exedescription pid process target process PID 456 set thread context of 796 456 ihtpueob.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 4816 sc.exe 5116 sc.exe 380 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exeihtpueob.exedescription pid process target process PID 4752 wrote to memory of 4660 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe cmd.exe PID 4752 wrote to memory of 4660 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe cmd.exe PID 4752 wrote to memory of 4660 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe cmd.exe PID 4752 wrote to memory of 4644 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe cmd.exe PID 4752 wrote to memory of 4644 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe cmd.exe PID 4752 wrote to memory of 4644 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe cmd.exe PID 4752 wrote to memory of 4816 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe sc.exe PID 4752 wrote to memory of 4816 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe sc.exe PID 4752 wrote to memory of 4816 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe sc.exe PID 4752 wrote to memory of 5116 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe sc.exe PID 4752 wrote to memory of 5116 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe sc.exe PID 4752 wrote to memory of 5116 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe sc.exe PID 4752 wrote to memory of 380 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe sc.exe PID 4752 wrote to memory of 380 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe sc.exe PID 4752 wrote to memory of 380 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe sc.exe PID 4752 wrote to memory of 3960 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe netsh.exe PID 4752 wrote to memory of 3960 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe netsh.exe PID 4752 wrote to memory of 3960 4752 5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe netsh.exe PID 456 wrote to memory of 796 456 ihtpueob.exe svchost.exe PID 456 wrote to memory of 796 456 ihtpueob.exe svchost.exe PID 456 wrote to memory of 796 456 ihtpueob.exe svchost.exe PID 456 wrote to memory of 796 456 ihtpueob.exe svchost.exe PID 456 wrote to memory of 796 456 ihtpueob.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe"C:\Users\Admin\AppData\Local\Temp\5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dbwdahuc\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ihtpueob.exe" C:\Windows\SysWOW64\dbwdahuc\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create dbwdahuc binPath= "C:\Windows\SysWOW64\dbwdahuc\ihtpueob.exe /d\"C:\Users\Admin\AppData\Local\Temp\5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description dbwdahuc "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start dbwdahuc2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\dbwdahuc\ihtpueob.exeC:\Windows\SysWOW64\dbwdahuc\ihtpueob.exe /d"C:\Users\Admin\AppData\Local\Temp\5dfa515315f72a107d3541ea8fa804fd364daf867578fc70e131ec52613b58c3.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ihtpueob.exeFilesize
13.2MB
MD59ad4bc4e8ff2646568f1b03fd5343dc8
SHA1544fa3e1af746be7043e5b3ab6f55c77de77b652
SHA256fa8ee7321c7746969b200698d35b9453e8d289fb8eff51a1bbb71334bf851bce
SHA512f6b146b031c95959bc2e1c890fd74ba72e9e47469eca1ce90742bbb5cd381c05a11eeaab6bfc371b9576f84f4f92a3d8d76c2aa81bb7f6398fe092ab2dbbc0a6
-
C:\Windows\SysWOW64\dbwdahuc\ihtpueob.exeFilesize
13.2MB
MD59ad4bc4e8ff2646568f1b03fd5343dc8
SHA1544fa3e1af746be7043e5b3ab6f55c77de77b652
SHA256fa8ee7321c7746969b200698d35b9453e8d289fb8eff51a1bbb71334bf851bce
SHA512f6b146b031c95959bc2e1c890fd74ba72e9e47469eca1ce90742bbb5cd381c05a11eeaab6bfc371b9576f84f4f92a3d8d76c2aa81bb7f6398fe092ab2dbbc0a6
-
memory/380-138-0x0000000000000000-mapping.dmp
-
memory/456-142-0x000000000541F000-0x000000000542E000-memory.dmpFilesize
60KB
-
memory/456-149-0x0000000000400000-0x00000000052AF000-memory.dmpFilesize
78.7MB
-
memory/456-147-0x000000000541F000-0x000000000542E000-memory.dmpFilesize
60KB
-
memory/796-143-0x0000000000000000-mapping.dmp
-
memory/796-150-0x0000000000E80000-0x0000000000E95000-memory.dmpFilesize
84KB
-
memory/796-148-0x0000000000E80000-0x0000000000E95000-memory.dmpFilesize
84KB
-
memory/796-144-0x0000000000E80000-0x0000000000E95000-memory.dmpFilesize
84KB
-
memory/3960-140-0x0000000000000000-mapping.dmp
-
memory/4644-134-0x0000000000000000-mapping.dmp
-
memory/4660-132-0x0000000000000000-mapping.dmp
-
memory/4752-141-0x0000000000400000-0x00000000052AF000-memory.dmpFilesize
78.7MB
-
memory/4752-130-0x0000000005343000-0x0000000005352000-memory.dmpFilesize
60KB
-
memory/4752-131-0x0000000005343000-0x0000000005352000-memory.dmpFilesize
60KB
-
memory/4752-133-0x0000000000400000-0x00000000052AF000-memory.dmpFilesize
78.7MB
-
memory/4816-136-0x0000000000000000-mapping.dmp
-
memory/5116-137-0x0000000000000000-mapping.dmp