Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 07:55
Static task
static1
Behavioral task
behavioral1
Sample
5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe
Resource
win10v2004-20220721-en
General
-
Target
5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe
-
Size
150KB
-
MD5
0c3e9598600bccf1d8b874bdda869bca
-
SHA1
aeb7cd8f3f96fc4113fed76d86fa2434f2069e5e
-
SHA256
5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0
-
SHA512
6a47074a26686433edd0ebdc0573fb3541328cecc2f87421c49bf2c0a5087e36ce3a9f7d3438c37229f9b182f31e3509cd5e3c4941583a946ea777cb5909fb31
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\xdmckxjp = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
gjrrpnra.exepid process 656 gjrrpnra.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xdmckxjp\ImagePath = "C:\\Windows\\SysWOW64\\xdmckxjp\\gjrrpnra.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1812 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
gjrrpnra.exedescription pid process target process PID 656 set thread context of 1812 656 gjrrpnra.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1036 sc.exe 984 sc.exe 616 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exegjrrpnra.exedescription pid process target process PID 1784 wrote to memory of 1100 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe cmd.exe PID 1784 wrote to memory of 1100 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe cmd.exe PID 1784 wrote to memory of 1100 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe cmd.exe PID 1784 wrote to memory of 1100 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe cmd.exe PID 1784 wrote to memory of 2004 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe cmd.exe PID 1784 wrote to memory of 2004 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe cmd.exe PID 1784 wrote to memory of 2004 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe cmd.exe PID 1784 wrote to memory of 2004 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe cmd.exe PID 1784 wrote to memory of 1036 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 1036 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 1036 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 1036 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 984 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 984 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 984 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 984 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 616 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 616 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 616 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 616 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe sc.exe PID 1784 wrote to memory of 1736 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe netsh.exe PID 1784 wrote to memory of 1736 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe netsh.exe PID 1784 wrote to memory of 1736 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe netsh.exe PID 1784 wrote to memory of 1736 1784 5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe netsh.exe PID 656 wrote to memory of 1812 656 gjrrpnra.exe svchost.exe PID 656 wrote to memory of 1812 656 gjrrpnra.exe svchost.exe PID 656 wrote to memory of 1812 656 gjrrpnra.exe svchost.exe PID 656 wrote to memory of 1812 656 gjrrpnra.exe svchost.exe PID 656 wrote to memory of 1812 656 gjrrpnra.exe svchost.exe PID 656 wrote to memory of 1812 656 gjrrpnra.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe"C:\Users\Admin\AppData\Local\Temp\5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xdmckxjp\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gjrrpnra.exe" C:\Windows\SysWOW64\xdmckxjp\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create xdmckxjp binPath= "C:\Windows\SysWOW64\xdmckxjp\gjrrpnra.exe /d\"C:\Users\Admin\AppData\Local\Temp\5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description xdmckxjp "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start xdmckxjp2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\xdmckxjp\gjrrpnra.exeC:\Windows\SysWOW64\xdmckxjp\gjrrpnra.exe /d"C:\Users\Admin\AppData\Local\Temp\5ff46bca8d033a58673c281fa26b7158c1d11ba6eca99a1553e2651fbb0256f0.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gjrrpnra.exeFilesize
11.4MB
MD50978200a9ba936e437e9368791209f64
SHA13e38c87ae45ae46d2ac142c577639d8acd986adf
SHA256e90711a34dfb8227144254d53a81b018ef13c7ea4d3b643456e1a7a7a77d5b49
SHA512c48886927effaaedd3f7055e0de6a6bafd72a1629de5ddf708dfcbc6fc0a61fc90f284ee994b5a634c8ddad1e3ce66ca90945a1fd2d9f22c416c5005a3889aee
-
C:\Windows\SysWOW64\xdmckxjp\gjrrpnra.exeFilesize
11.4MB
MD50978200a9ba936e437e9368791209f64
SHA13e38c87ae45ae46d2ac142c577639d8acd986adf
SHA256e90711a34dfb8227144254d53a81b018ef13c7ea4d3b643456e1a7a7a77d5b49
SHA512c48886927effaaedd3f7055e0de6a6bafd72a1629de5ddf708dfcbc6fc0a61fc90f284ee994b5a634c8ddad1e3ce66ca90945a1fd2d9f22c416c5005a3889aee
-
memory/616-62-0x0000000000000000-mapping.dmp
-
memory/656-75-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/656-68-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/656-66-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/984-61-0x0000000000000000-mapping.dmp
-
memory/1036-60-0x0000000000000000-mapping.dmp
-
memory/1100-57-0x0000000000000000-mapping.dmp
-
memory/1736-64-0x0000000000000000-mapping.dmp
-
memory/1784-54-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1784-65-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1784-56-0x0000000075661000-0x0000000075663000-memory.dmpFilesize
8KB
-
memory/1784-55-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1812-70-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/1812-72-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/1812-73-0x00000000000D9A6B-mapping.dmp
-
memory/1812-78-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/1812-79-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/2004-58-0x0000000000000000-mapping.dmp