Analysis
-
max time kernel
151s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
01-08-2022 15:15
Static task
static1
Behavioral task
behavioral1
Sample
5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe
Resource
win10v2004-20220721-en
General
-
Target
5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe
-
Size
153KB
-
MD5
c8f91e493d1e36838e613915dea38aef
-
SHA1
b4b6ae99c4ba7bfefbfab627c41702a458cbefc1
-
SHA256
5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959
-
SHA512
62d2b5b49721969479efade45d43da049e3c1cadef12b7ef0b996a5e35bca5ac4acb27fefb77e0e4494aefead3fb363934d7116def0298a9e4106c1cb4c99830
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\xhyhanms = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
qocopkio.exepid process 308 qocopkio.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xhyhanms\ImagePath = "C:\\Windows\\SysWOW64\\xhyhanms\\qocopkio.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1212 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
qocopkio.exedescription pid process target process PID 308 set thread context of 1212 308 qocopkio.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1360 sc.exe 1972 sc.exe 1068 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exeqocopkio.exedescription pid process target process PID 960 wrote to memory of 1384 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe cmd.exe PID 960 wrote to memory of 1384 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe cmd.exe PID 960 wrote to memory of 1384 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe cmd.exe PID 960 wrote to memory of 1384 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe cmd.exe PID 960 wrote to memory of 1276 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe cmd.exe PID 960 wrote to memory of 1276 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe cmd.exe PID 960 wrote to memory of 1276 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe cmd.exe PID 960 wrote to memory of 1276 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe cmd.exe PID 960 wrote to memory of 1360 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1360 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1360 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1360 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1972 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1972 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1972 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1972 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1068 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1068 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1068 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 1068 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe sc.exe PID 960 wrote to memory of 268 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe netsh.exe PID 960 wrote to memory of 268 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe netsh.exe PID 960 wrote to memory of 268 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe netsh.exe PID 960 wrote to memory of 268 960 5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe netsh.exe PID 308 wrote to memory of 1212 308 qocopkio.exe svchost.exe PID 308 wrote to memory of 1212 308 qocopkio.exe svchost.exe PID 308 wrote to memory of 1212 308 qocopkio.exe svchost.exe PID 308 wrote to memory of 1212 308 qocopkio.exe svchost.exe PID 308 wrote to memory of 1212 308 qocopkio.exe svchost.exe PID 308 wrote to memory of 1212 308 qocopkio.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe"C:\Users\Admin\AppData\Local\Temp\5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xhyhanms\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qocopkio.exe" C:\Windows\SysWOW64\xhyhanms\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create xhyhanms binPath= "C:\Windows\SysWOW64\xhyhanms\qocopkio.exe /d\"C:\Users\Admin\AppData\Local\Temp\5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description xhyhanms "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start xhyhanms2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\xhyhanms\qocopkio.exeC:\Windows\SysWOW64\xhyhanms\qocopkio.exe /d"C:\Users\Admin\AppData\Local\Temp\5c3b9c929cac14277c3f810b57a487a6093470e3b4fd56ac65ab2d3f6b4e9959.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qocopkio.exeFilesize
14.8MB
MD56d84131c77c35a97a35007dc550a4b09
SHA12c624aaa2ddf019d1c5ed1a178aad509768fa7bf
SHA256bd9e3e6e32a622557fe267a670ca935e27d90c7e3408bdf4e560d58f5030210e
SHA512ce244f5dbc6606684b05f0a24bfd9fe0a6046da29cc261d30c623d1771b99365fe6113b1950886f1d775771f142faa6124467d0f6c85533049811ee9e1aabe3e
-
C:\Windows\SysWOW64\xhyhanms\qocopkio.exeFilesize
14.8MB
MD56d84131c77c35a97a35007dc550a4b09
SHA12c624aaa2ddf019d1c5ed1a178aad509768fa7bf
SHA256bd9e3e6e32a622557fe267a670ca935e27d90c7e3408bdf4e560d58f5030210e
SHA512ce244f5dbc6606684b05f0a24bfd9fe0a6046da29cc261d30c623d1771b99365fe6113b1950886f1d775771f142faa6124467d0f6c85533049811ee9e1aabe3e
-
memory/268-62-0x0000000000000000-mapping.dmp
-
memory/308-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/960-55-0x0000000075301000-0x0000000075303000-memory.dmpFilesize
8KB
-
memory/960-54-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1068-61-0x0000000000000000-mapping.dmp
-
memory/1212-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1212-67-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1212-70-0x0000000000089A6B-mapping.dmp
-
memory/1212-73-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1212-74-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1212-75-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1276-57-0x0000000000000000-mapping.dmp
-
memory/1360-59-0x0000000000000000-mapping.dmp
-
memory/1384-56-0x0000000000000000-mapping.dmp
-
memory/1972-60-0x0000000000000000-mapping.dmp