Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-11-2022 22:37
Static task
static1
Behavioral task
behavioral1
Sample
af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe
Resource
win10-20220812-en
General
-
Target
af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe
-
Size
167KB
-
MD5
65e43f6b5f4bbf71f6ecab7473d5f169
-
SHA1
647be05e012efc56178c827e429208f773e7358c
-
SHA256
af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc
-
SHA512
9da8f0b9be029a65d2971ccb936a0c0a08a33275f3260ac232f497744ba8bb088dd377a0aaf2c083cdc3d2bb0d1f39d9af19ac79f245276ce64c43fe1adb07c9
-
SSDEEP
3072:RPJ1pyY1u2XpS5VL7++e3BuFF9uOnWR0vkqNuG2:N0iZXh+eKFlWmk+u
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\qwfjyalk = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
nmlmnxzc.exepid process 4472 nmlmnxzc.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\qwfjyalk\ImagePath = "C:\\Windows\\SysWOW64\\qwfjyalk\\nmlmnxzc.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 5052 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
nmlmnxzc.exedescription pid process target process PID 4472 set thread context of 5052 4472 nmlmnxzc.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 3560 sc.exe 2224 sc.exe 4904 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exenmlmnxzc.exedescription pid process target process PID 2016 wrote to memory of 4804 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe cmd.exe PID 2016 wrote to memory of 4804 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe cmd.exe PID 2016 wrote to memory of 4804 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe cmd.exe PID 2016 wrote to memory of 392 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe cmd.exe PID 2016 wrote to memory of 392 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe cmd.exe PID 2016 wrote to memory of 392 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe cmd.exe PID 2016 wrote to memory of 3560 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe sc.exe PID 2016 wrote to memory of 3560 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe sc.exe PID 2016 wrote to memory of 3560 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe sc.exe PID 2016 wrote to memory of 2224 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe sc.exe PID 2016 wrote to memory of 2224 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe sc.exe PID 2016 wrote to memory of 2224 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe sc.exe PID 2016 wrote to memory of 4904 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe sc.exe PID 2016 wrote to memory of 4904 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe sc.exe PID 2016 wrote to memory of 4904 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe sc.exe PID 2016 wrote to memory of 3036 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe netsh.exe PID 2016 wrote to memory of 3036 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe netsh.exe PID 2016 wrote to memory of 3036 2016 af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe netsh.exe PID 4472 wrote to memory of 5052 4472 nmlmnxzc.exe svchost.exe PID 4472 wrote to memory of 5052 4472 nmlmnxzc.exe svchost.exe PID 4472 wrote to memory of 5052 4472 nmlmnxzc.exe svchost.exe PID 4472 wrote to memory of 5052 4472 nmlmnxzc.exe svchost.exe PID 4472 wrote to memory of 5052 4472 nmlmnxzc.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe"C:\Users\Admin\AppData\Local\Temp\af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qwfjyalk\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\nmlmnxzc.exe" C:\Windows\SysWOW64\qwfjyalk\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create qwfjyalk binPath= "C:\Windows\SysWOW64\qwfjyalk\nmlmnxzc.exe /d\"C:\Users\Admin\AppData\Local\Temp\af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description qwfjyalk "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start qwfjyalk2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\qwfjyalk\nmlmnxzc.exeC:\Windows\SysWOW64\qwfjyalk\nmlmnxzc.exe /d"C:\Users\Admin\AppData\Local\Temp\af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nmlmnxzc.exeFilesize
13.0MB
MD5d7f6e4319ae8c702e6206c8cb2e5fd6a
SHA11e20d86db9874e3bca239d70bab706e3de16cf30
SHA256afceb4e56cb7f57b041bddd0a15468d1874cd1e257b172a853350a36e6f0dfc7
SHA5124702b624123dfd93e8daaa5c888faa7bc3af59abe7368bf0d550aae24392d32973bd1de5ad02f7ab12bab4aabd310c40cdd284ac47942dccd14a41fb3dbe1be5
-
C:\Windows\SysWOW64\qwfjyalk\nmlmnxzc.exeFilesize
13.0MB
MD5d7f6e4319ae8c702e6206c8cb2e5fd6a
SHA11e20d86db9874e3bca239d70bab706e3de16cf30
SHA256afceb4e56cb7f57b041bddd0a15468d1874cd1e257b172a853350a36e6f0dfc7
SHA5124702b624123dfd93e8daaa5c888faa7bc3af59abe7368bf0d550aae24392d32973bd1de5ad02f7ab12bab4aabd310c40cdd284ac47942dccd14a41fb3dbe1be5
-
memory/392-178-0x0000000000000000-mapping.dmp
-
memory/392-179-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/392-180-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/392-181-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/392-182-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/392-183-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-158-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-151-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-125-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-126-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-127-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-128-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-129-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-130-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-131-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-133-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-132-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-134-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-135-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-136-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-137-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-138-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-139-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-140-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-141-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-143-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-144-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-145-0x0000000000840000-0x000000000098A000-memory.dmpFilesize
1.3MB
-
memory/2016-146-0x0000000002440000-0x0000000002453000-memory.dmpFilesize
76KB
-
memory/2016-147-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-148-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-149-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-150-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-124-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-152-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-153-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-154-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-155-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-156-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-157-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-123-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-159-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2016-161-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-120-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-224-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2016-163-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-164-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-165-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-166-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-167-0x0000000002440000-0x0000000002453000-memory.dmpFilesize
76KB
-
memory/2016-168-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-169-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-170-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-171-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-160-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-122-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-121-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2016-162-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/2224-194-0x0000000000000000-mapping.dmp
-
memory/3036-218-0x0000000000000000-mapping.dmp
-
memory/3560-185-0x0000000000000000-mapping.dmp
-
memory/3560-187-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3560-190-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3560-191-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3560-192-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3560-186-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3560-189-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/3560-188-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4472-327-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4472-318-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/4472-317-0x0000000000903000-0x0000000000914000-memory.dmpFilesize
68KB
-
memory/4472-325-0x0000000000903000-0x0000000000914000-memory.dmpFilesize
68KB
-
memory/4804-173-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4804-177-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4804-176-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4804-175-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4804-172-0x0000000000000000-mapping.dmp
-
memory/4804-174-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/4904-207-0x0000000000000000-mapping.dmp
-
memory/5052-321-0x0000000000609A6B-mapping.dmp
-
memory/5052-362-0x0000000000600000-0x0000000000615000-memory.dmpFilesize
84KB
-
memory/5052-489-0x0000000000600000-0x0000000000615000-memory.dmpFilesize
84KB