Analysis
-
max time kernel
144s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 22:38
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
General
-
Target
file.exe
-
Size
167KB
-
MD5
65e43f6b5f4bbf71f6ecab7473d5f169
-
SHA1
647be05e012efc56178c827e429208f773e7358c
-
SHA256
af4515bb1ca19b5fdc2cf47391594cb4ca3f2c3063a1c703e4331e741d31e4fc
-
SHA512
9da8f0b9be029a65d2971ccb936a0c0a08a33275f3260ac232f497744ba8bb088dd377a0aaf2c083cdc3d2bb0d1f39d9af19ac79f245276ce64c43fe1adb07c9
-
SSDEEP
3072:RPJ1pyY1u2XpS5VL7++e3BuFF9uOnWR0vkqNuG2:N0iZXh+eKFlWmk+u
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\coocpdyy = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
lfvmpnqz.exepid process 1316 lfvmpnqz.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\coocpdyy\ImagePath = "C:\\Windows\\SysWOW64\\coocpdyy\\lfvmpnqz.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1516 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
lfvmpnqz.exedescription pid process target process PID 1316 set thread context of 1516 1316 lfvmpnqz.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 560 sc.exe 1696 sc.exe 1996 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
file.exelfvmpnqz.exedescription pid process target process PID 2016 wrote to memory of 1924 2016 file.exe cmd.exe PID 2016 wrote to memory of 1924 2016 file.exe cmd.exe PID 2016 wrote to memory of 1924 2016 file.exe cmd.exe PID 2016 wrote to memory of 1924 2016 file.exe cmd.exe PID 2016 wrote to memory of 1964 2016 file.exe cmd.exe PID 2016 wrote to memory of 1964 2016 file.exe cmd.exe PID 2016 wrote to memory of 1964 2016 file.exe cmd.exe PID 2016 wrote to memory of 1964 2016 file.exe cmd.exe PID 2016 wrote to memory of 560 2016 file.exe sc.exe PID 2016 wrote to memory of 560 2016 file.exe sc.exe PID 2016 wrote to memory of 560 2016 file.exe sc.exe PID 2016 wrote to memory of 560 2016 file.exe sc.exe PID 2016 wrote to memory of 1696 2016 file.exe sc.exe PID 2016 wrote to memory of 1696 2016 file.exe sc.exe PID 2016 wrote to memory of 1696 2016 file.exe sc.exe PID 2016 wrote to memory of 1696 2016 file.exe sc.exe PID 2016 wrote to memory of 1996 2016 file.exe sc.exe PID 2016 wrote to memory of 1996 2016 file.exe sc.exe PID 2016 wrote to memory of 1996 2016 file.exe sc.exe PID 2016 wrote to memory of 1996 2016 file.exe sc.exe PID 2016 wrote to memory of 1412 2016 file.exe netsh.exe PID 2016 wrote to memory of 1412 2016 file.exe netsh.exe PID 2016 wrote to memory of 1412 2016 file.exe netsh.exe PID 2016 wrote to memory of 1412 2016 file.exe netsh.exe PID 1316 wrote to memory of 1516 1316 lfvmpnqz.exe svchost.exe PID 1316 wrote to memory of 1516 1316 lfvmpnqz.exe svchost.exe PID 1316 wrote to memory of 1516 1316 lfvmpnqz.exe svchost.exe PID 1316 wrote to memory of 1516 1316 lfvmpnqz.exe svchost.exe PID 1316 wrote to memory of 1516 1316 lfvmpnqz.exe svchost.exe PID 1316 wrote to memory of 1516 1316 lfvmpnqz.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\coocpdyy\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lfvmpnqz.exe" C:\Windows\SysWOW64\coocpdyy\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create coocpdyy binPath= "C:\Windows\SysWOW64\coocpdyy\lfvmpnqz.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description coocpdyy "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start coocpdyy2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\coocpdyy\lfvmpnqz.exeC:\Windows\SysWOW64\coocpdyy\lfvmpnqz.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\lfvmpnqz.exeFilesize
14.0MB
MD5a4c96231407b7af4ebdba9b60c5e94a9
SHA156abea627ac56869fca54f423fcdce87db85415d
SHA256ce56d688ba5c060850676eda25b194d7b8a8ea2fe5570cc527416d601530baa2
SHA5126015cb39469fad2e9206b36bda67f024799997555165f79bf3f79a87850602f0bbe34b318e5be76d3ad24466b23b3f9d99e717a88e35f5733ea526ad3dc70093
-
C:\Windows\SysWOW64\coocpdyy\lfvmpnqz.exeFilesize
14.0MB
MD5a4c96231407b7af4ebdba9b60c5e94a9
SHA156abea627ac56869fca54f423fcdce87db85415d
SHA256ce56d688ba5c060850676eda25b194d7b8a8ea2fe5570cc527416d601530baa2
SHA5126015cb39469fad2e9206b36bda67f024799997555165f79bf3f79a87850602f0bbe34b318e5be76d3ad24466b23b3f9d99e717a88e35f5733ea526ad3dc70093
-
memory/560-61-0x0000000000000000-mapping.dmp
-
memory/1316-77-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/1316-76-0x00000000002EB000-0x00000000002FC000-memory.dmpFilesize
68KB
-
memory/1412-65-0x0000000000000000-mapping.dmp
-
memory/1516-71-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1516-72-0x0000000000089A6B-mapping.dmp
-
memory/1516-80-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1516-79-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1516-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1696-62-0x0000000000000000-mapping.dmp
-
memory/1924-55-0x0000000000000000-mapping.dmp
-
memory/1964-59-0x0000000000000000-mapping.dmp
-
memory/1996-63-0x0000000000000000-mapping.dmp
-
memory/2016-58-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/2016-57-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/2016-67-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2016-56-0x000000000081B000-0x000000000082C000-memory.dmpFilesize
68KB
-
memory/2016-66-0x000000000081B000-0x000000000082C000-memory.dmpFilesize
68KB