Analysis
-
max time kernel
161s -
max time network
222s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 10:46
Static task
static1
Behavioral task
behavioral1
Sample
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe
Resource
win10v2004-20220721-en
General
-
Target
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe
-
Size
142KB
-
MD5
e4e980a178180b5aa5f096c10e9f5557
-
SHA1
f55b0a91c0cc81e61d6f23b8695ce4fa917f04d6
-
SHA256
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724
-
SHA512
5f762ee974d14b69deb25266835644a20862f2da14f64bde6885ff27e1250b840d6cf44f3f3b36742b1502692f879382ccc59c8cab08d56b299cd8c71a3f6109
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
cxxeamcu.exepid process 1356 cxxeamcu.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\phhiubmg\ImagePath = "C:\\Windows\\SysWOW64\\phhiubmg\\cxxeamcu.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1204 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cxxeamcu.exedescription pid process target process PID 1356 set thread context of 1204 1356 cxxeamcu.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1880 sc.exe 656 sc.exe 1888 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.execxxeamcu.exedescription pid process target process PID 1948 wrote to memory of 2016 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe cmd.exe PID 1948 wrote to memory of 2016 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe cmd.exe PID 1948 wrote to memory of 2016 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe cmd.exe PID 1948 wrote to memory of 2016 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe cmd.exe PID 1948 wrote to memory of 944 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe cmd.exe PID 1948 wrote to memory of 944 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe cmd.exe PID 1948 wrote to memory of 944 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe cmd.exe PID 1948 wrote to memory of 944 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe cmd.exe PID 1948 wrote to memory of 1880 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 1880 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 1880 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 1880 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 656 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 656 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 656 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 656 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 1888 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 1888 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 1888 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 1888 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe sc.exe PID 1948 wrote to memory of 1772 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe netsh.exe PID 1948 wrote to memory of 1772 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe netsh.exe PID 1948 wrote to memory of 1772 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe netsh.exe PID 1948 wrote to memory of 1772 1948 5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe netsh.exe PID 1356 wrote to memory of 1204 1356 cxxeamcu.exe svchost.exe PID 1356 wrote to memory of 1204 1356 cxxeamcu.exe svchost.exe PID 1356 wrote to memory of 1204 1356 cxxeamcu.exe svchost.exe PID 1356 wrote to memory of 1204 1356 cxxeamcu.exe svchost.exe PID 1356 wrote to memory of 1204 1356 cxxeamcu.exe svchost.exe PID 1356 wrote to memory of 1204 1356 cxxeamcu.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe"C:\Users\Admin\AppData\Local\Temp\5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\phhiubmg\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\cxxeamcu.exe" C:\Windows\SysWOW64\phhiubmg\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create phhiubmg binPath= "C:\Windows\SysWOW64\phhiubmg\cxxeamcu.exe /d\"C:\Users\Admin\AppData\Local\Temp\5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description phhiubmg "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start phhiubmg2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\phhiubmg\cxxeamcu.exeC:\Windows\SysWOW64\phhiubmg\cxxeamcu.exe /d"C:\Users\Admin\AppData\Local\Temp\5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cxxeamcu.exeFilesize
10.2MB
MD59f71711f451e411419960003ca9615ad
SHA15a642513266a86907a4a6c62726bf8ae5f5111e3
SHA256fbe5e2bd65abedb6f82be139463e59ddc1290dd3dda77b7ed33c7a7e2b5dd429
SHA512b14fb29ae5e13ea3de741a93278897ab44f616f0bef4250581458107a636e94a24b89bbcfdedebf6293bc11070ed446acbe9f3acebcf406c0ccd4b39554dde3b
-
C:\Windows\SysWOW64\phhiubmg\cxxeamcu.exeFilesize
10.2MB
MD59f71711f451e411419960003ca9615ad
SHA15a642513266a86907a4a6c62726bf8ae5f5111e3
SHA256fbe5e2bd65abedb6f82be139463e59ddc1290dd3dda77b7ed33c7a7e2b5dd429
SHA512b14fb29ae5e13ea3de741a93278897ab44f616f0bef4250581458107a636e94a24b89bbcfdedebf6293bc11070ed446acbe9f3acebcf406c0ccd4b39554dde3b
-
memory/656-60-0x0000000000000000-mapping.dmp
-
memory/944-57-0x0000000000000000-mapping.dmp
-
memory/1204-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1204-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1204-70-0x0000000000089A6B-mapping.dmp
-
memory/1204-73-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1204-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1204-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1356-65-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1772-62-0x0000000000000000-mapping.dmp
-
memory/1880-59-0x0000000000000000-mapping.dmp
-
memory/1888-61-0x0000000000000000-mapping.dmp
-
memory/1948-55-0x0000000075141000-0x0000000075143000-memory.dmpFilesize
8KB
-
memory/1948-54-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/2016-56-0x0000000000000000-mapping.dmp