Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 22:40
Static task
static1
Behavioral task
behavioral1
Sample
5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe
Resource
win10v2004-20220721-en
General
-
Target
5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe
-
Size
137KB
-
MD5
d9d34d8d20cf3b58ed3cca5d0c617dbd
-
SHA1
cd6e7f7b01361e49f986dd98475ad741fb436a53
-
SHA256
5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb
-
SHA512
042708d3ec9794b9045c4b96b5e5a59d9c6ad59e3c69e1eb1c31e47b720c23bca99bb4c837edfaf64f997a30ac0e54b617102cb72d00c7dcb671b88a82dc6004
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
cxxeamcu.exepid process 1676 cxxeamcu.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\sqplnhch\ImagePath = "C:\\Windows\\SysWOW64\\sqplnhch\\cxxeamcu.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1688 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cxxeamcu.exedescription pid process target process PID 1676 set thread context of 1688 1676 cxxeamcu.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1956 sc.exe 1740 sc.exe 1580 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.execxxeamcu.exedescription pid process target process PID 1680 wrote to memory of 1152 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe cmd.exe PID 1680 wrote to memory of 1152 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe cmd.exe PID 1680 wrote to memory of 1152 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe cmd.exe PID 1680 wrote to memory of 1152 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe cmd.exe PID 1680 wrote to memory of 2008 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe cmd.exe PID 1680 wrote to memory of 2008 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe cmd.exe PID 1680 wrote to memory of 2008 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe cmd.exe PID 1680 wrote to memory of 2008 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe cmd.exe PID 1680 wrote to memory of 1956 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1956 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1956 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1956 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1740 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1740 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1740 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1740 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1580 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1580 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1580 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 1580 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe sc.exe PID 1680 wrote to memory of 840 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe netsh.exe PID 1680 wrote to memory of 840 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe netsh.exe PID 1680 wrote to memory of 840 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe netsh.exe PID 1680 wrote to memory of 840 1680 5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe netsh.exe PID 1676 wrote to memory of 1688 1676 cxxeamcu.exe svchost.exe PID 1676 wrote to memory of 1688 1676 cxxeamcu.exe svchost.exe PID 1676 wrote to memory of 1688 1676 cxxeamcu.exe svchost.exe PID 1676 wrote to memory of 1688 1676 cxxeamcu.exe svchost.exe PID 1676 wrote to memory of 1688 1676 cxxeamcu.exe svchost.exe PID 1676 wrote to memory of 1688 1676 cxxeamcu.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe"C:\Users\Admin\AppData\Local\Temp\5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sqplnhch\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cxxeamcu.exe" C:\Windows\SysWOW64\sqplnhch\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create sqplnhch binPath= "C:\Windows\SysWOW64\sqplnhch\cxxeamcu.exe /d\"C:\Users\Admin\AppData\Local\Temp\5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description sqplnhch "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start sqplnhch2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\sqplnhch\cxxeamcu.exeC:\Windows\SysWOW64\sqplnhch\cxxeamcu.exe /d"C:\Users\Admin\AppData\Local\Temp\5db2f772773cf804bafbf0801dc11a29093678fc9270cd1f350ab289557b91eb.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cxxeamcu.exeFilesize
11.2MB
MD5958f7718dad7ad69a4a5a6ec316603e0
SHA1e70239a70eff1b7c0db1c2aacb2b67dadc924adf
SHA256b2a1e05377d72d9977a9756caccddf49c851a68254601fd133fb06efa4a26b3e
SHA512604dd169e7bc3bd6056e40012de59610e522b88323ff31a073b7235d8cec416daa9c89b90ffa7097c79191b728e8d095919295de41fc62ae8667187e7ae8b57b
-
C:\Windows\SysWOW64\sqplnhch\cxxeamcu.exeFilesize
11.2MB
MD5958f7718dad7ad69a4a5a6ec316603e0
SHA1e70239a70eff1b7c0db1c2aacb2b67dadc924adf
SHA256b2a1e05377d72d9977a9756caccddf49c851a68254601fd133fb06efa4a26b3e
SHA512604dd169e7bc3bd6056e40012de59610e522b88323ff31a073b7235d8cec416daa9c89b90ffa7097c79191b728e8d095919295de41fc62ae8667187e7ae8b57b
-
memory/840-63-0x0000000000000000-mapping.dmp
-
memory/1152-56-0x0000000000000000-mapping.dmp
-
memory/1580-61-0x0000000000000000-mapping.dmp
-
memory/1676-65-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1680-54-0x0000000000400000-0x0000000000425000-memory.dmpFilesize
148KB
-
memory/1680-55-0x00000000756C1000-0x00000000756C3000-memory.dmpFilesize
8KB
-
memory/1688-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1688-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1688-70-0x0000000000089A6B-mapping.dmp
-
memory/1688-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1688-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1740-60-0x0000000000000000-mapping.dmp
-
memory/1956-59-0x0000000000000000-mapping.dmp
-
memory/2008-57-0x0000000000000000-mapping.dmp