Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 23:28
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
General
-
Target
file.exe
-
Size
167KB
-
MD5
db37e2dceca24b2a30667e7a26816e5a
-
SHA1
a52d6f9718d4cb71f623f463cd590f76ad04878c
-
SHA256
997f091cec1b6b0ca4c760582289f88fc845072e15d22fb9ebbc70d8a411eb34
-
SHA512
b1f0795046296ce3ded9b195d40308999d3800f6886abff6730df2a047f30d3188828b48bd697069f51f038d8ff876d69e07563ef242070b30e219dce04b948c
-
SSDEEP
3072:MVtkj/2yjSgA2EVu5W+L/l5JYmsd//FuJpXxS5osnN:MnK+gA2EIL/lYZFupXI/
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
bhzotmd.exepid process 3904 bhzotmd.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ubghzjgj\ImagePath = "C:\\Windows\\SysWOW64\\ubghzjgj\\bhzotmd.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
file.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation file.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bhzotmd.exedescription pid process target process PID 3904 set thread context of 4604 3904 bhzotmd.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 4260 sc.exe 1764 sc.exe 3912 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
file.exebhzotmd.exedescription pid process target process PID 5052 wrote to memory of 4512 5052 file.exe cmd.exe PID 5052 wrote to memory of 4512 5052 file.exe cmd.exe PID 5052 wrote to memory of 4512 5052 file.exe cmd.exe PID 5052 wrote to memory of 1412 5052 file.exe cmd.exe PID 5052 wrote to memory of 1412 5052 file.exe cmd.exe PID 5052 wrote to memory of 1412 5052 file.exe cmd.exe PID 5052 wrote to memory of 1764 5052 file.exe sc.exe PID 5052 wrote to memory of 1764 5052 file.exe sc.exe PID 5052 wrote to memory of 1764 5052 file.exe sc.exe PID 5052 wrote to memory of 3912 5052 file.exe sc.exe PID 5052 wrote to memory of 3912 5052 file.exe sc.exe PID 5052 wrote to memory of 3912 5052 file.exe sc.exe PID 5052 wrote to memory of 4260 5052 file.exe sc.exe PID 5052 wrote to memory of 4260 5052 file.exe sc.exe PID 5052 wrote to memory of 4260 5052 file.exe sc.exe PID 5052 wrote to memory of 3980 5052 file.exe netsh.exe PID 5052 wrote to memory of 3980 5052 file.exe netsh.exe PID 5052 wrote to memory of 3980 5052 file.exe netsh.exe PID 3904 wrote to memory of 4604 3904 bhzotmd.exe svchost.exe PID 3904 wrote to memory of 4604 3904 bhzotmd.exe svchost.exe PID 3904 wrote to memory of 4604 3904 bhzotmd.exe svchost.exe PID 3904 wrote to memory of 4604 3904 bhzotmd.exe svchost.exe PID 3904 wrote to memory of 4604 3904 bhzotmd.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ubghzjgj\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bhzotmd.exe" C:\Windows\SysWOW64\ubghzjgj\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ubghzjgj binPath= "C:\Windows\SysWOW64\ubghzjgj\bhzotmd.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ubghzjgj "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ubghzjgj2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\ubghzjgj\bhzotmd.exeC:\Windows\SysWOW64\ubghzjgj\bhzotmd.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bhzotmd.exeFilesize
13.0MB
MD5c775be10a204cdfdbd1854c6231f547d
SHA1506710a1f4dd19d9f635351926ddb6d81059c596
SHA2569612e630417beba4cfd9e76b8685de422fabea6caf192494fa61cfaad53bc213
SHA5123153d295fb3e65c4b012043cfda38619f49ddb27dd96bec80cbefc59375d768a8f6864a9dc5ea7c557270ec0c7453a9532311951b4c567e7b7472cf73b7817ad
-
C:\Windows\SysWOW64\ubghzjgj\bhzotmd.exeFilesize
13.0MB
MD5c775be10a204cdfdbd1854c6231f547d
SHA1506710a1f4dd19d9f635351926ddb6d81059c596
SHA2569612e630417beba4cfd9e76b8685de422fabea6caf192494fa61cfaad53bc213
SHA5123153d295fb3e65c4b012043cfda38619f49ddb27dd96bec80cbefc59375d768a8f6864a9dc5ea7c557270ec0c7453a9532311951b4c567e7b7472cf73b7817ad
-
memory/1412-136-0x0000000000000000-mapping.dmp
-
memory/1764-138-0x0000000000000000-mapping.dmp
-
memory/3904-149-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/3904-146-0x0000000000A78000-0x0000000000A88000-memory.dmpFilesize
64KB
-
memory/3912-139-0x0000000000000000-mapping.dmp
-
memory/3980-142-0x0000000000000000-mapping.dmp
-
memory/4260-140-0x0000000000000000-mapping.dmp
-
memory/4512-135-0x0000000000000000-mapping.dmp
-
memory/4604-144-0x0000000000000000-mapping.dmp
-
memory/4604-145-0x00000000009A0000-0x00000000009B5000-memory.dmpFilesize
84KB
-
memory/4604-150-0x00000000009A0000-0x00000000009B5000-memory.dmpFilesize
84KB
-
memory/4604-151-0x00000000009A0000-0x00000000009B5000-memory.dmpFilesize
84KB
-
memory/5052-132-0x000000000080D000-0x000000000081D000-memory.dmpFilesize
64KB
-
memory/5052-143-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/5052-134-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/5052-133-0x0000000002450000-0x0000000002463000-memory.dmpFilesize
76KB