Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:30
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
168KB
-
MD5
c8789056c4fa188b6f6d23e2da5e8655
-
SHA1
bffc6adeee841c0976e31d6518bab3f5e85bd589
-
SHA256
d4c8775b95b6d0f4c5384a6526afa7f00aeabb08aa6a1fe545e4193d60a2c205
-
SHA512
be89c3d2b76c2da856395a0d935206d9a1da034f501d8a029a8925903328cfad4e4d21ada9fe646e51fd046b197edf49f6666cc9b0d4fc2926009567cd20fba1
-
SSDEEP
3072:9omFCseno3BYS59iEemUxOCzpSu0Ih2Wzb:Rheo3BhezxpCIA
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\akqbjsgu = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
yadojdst.exepid process 1632 yadojdst.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\akqbjsgu\ImagePath = "C:\\Windows\\SysWOW64\\akqbjsgu\\yadojdst.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1516 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
yadojdst.exedescription pid process target process PID 1632 set thread context of 1516 1632 yadojdst.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1692 sc.exe 1716 sc.exe 1868 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
file.exeyadojdst.exedescription pid process target process PID 2016 wrote to memory of 1896 2016 file.exe cmd.exe PID 2016 wrote to memory of 1896 2016 file.exe cmd.exe PID 2016 wrote to memory of 1896 2016 file.exe cmd.exe PID 2016 wrote to memory of 1896 2016 file.exe cmd.exe PID 2016 wrote to memory of 1724 2016 file.exe cmd.exe PID 2016 wrote to memory of 1724 2016 file.exe cmd.exe PID 2016 wrote to memory of 1724 2016 file.exe cmd.exe PID 2016 wrote to memory of 1724 2016 file.exe cmd.exe PID 2016 wrote to memory of 1692 2016 file.exe sc.exe PID 2016 wrote to memory of 1692 2016 file.exe sc.exe PID 2016 wrote to memory of 1692 2016 file.exe sc.exe PID 2016 wrote to memory of 1692 2016 file.exe sc.exe PID 2016 wrote to memory of 1716 2016 file.exe sc.exe PID 2016 wrote to memory of 1716 2016 file.exe sc.exe PID 2016 wrote to memory of 1716 2016 file.exe sc.exe PID 2016 wrote to memory of 1716 2016 file.exe sc.exe PID 2016 wrote to memory of 1868 2016 file.exe sc.exe PID 2016 wrote to memory of 1868 2016 file.exe sc.exe PID 2016 wrote to memory of 1868 2016 file.exe sc.exe PID 2016 wrote to memory of 1868 2016 file.exe sc.exe PID 2016 wrote to memory of 900 2016 file.exe netsh.exe PID 2016 wrote to memory of 900 2016 file.exe netsh.exe PID 2016 wrote to memory of 900 2016 file.exe netsh.exe PID 2016 wrote to memory of 900 2016 file.exe netsh.exe PID 1632 wrote to memory of 1516 1632 yadojdst.exe svchost.exe PID 1632 wrote to memory of 1516 1632 yadojdst.exe svchost.exe PID 1632 wrote to memory of 1516 1632 yadojdst.exe svchost.exe PID 1632 wrote to memory of 1516 1632 yadojdst.exe svchost.exe PID 1632 wrote to memory of 1516 1632 yadojdst.exe svchost.exe PID 1632 wrote to memory of 1516 1632 yadojdst.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\akqbjsgu\2⤵PID:1896
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yadojdst.exe" C:\Windows\SysWOW64\akqbjsgu\2⤵PID:1724
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create akqbjsgu binPath= "C:\Windows\SysWOW64\akqbjsgu\yadojdst.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:1692 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description akqbjsgu "wifi internet conection"2⤵
- Launches sc.exe
PID:1716 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start akqbjsgu2⤵
- Launches sc.exe
PID:1868 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:900
-
C:\Windows\SysWOW64\akqbjsgu\yadojdst.exeC:\Windows\SysWOW64\akqbjsgu\yadojdst.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:1516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\yadojdst.exeFilesize
13.6MB
MD5241d411b5bd9c10abff3fef9a955a804
SHA14caf4c3e35f091d6acfe773668f5e4692e537797
SHA2560578d78625301b84e2e8ebdca3068c3eba0f42e5debbb30938f61d250f3ff975
SHA512395dbb4ba7e888356d1b926e29f2ac1650411588d510270d17db4928c6aef26083477aabf34e38d30ac504f939271866a0509eb56d60115ef42940252e4f956e
-
C:\Windows\SysWOW64\akqbjsgu\yadojdst.exeFilesize
13.6MB
MD5241d411b5bd9c10abff3fef9a955a804
SHA14caf4c3e35f091d6acfe773668f5e4692e537797
SHA2560578d78625301b84e2e8ebdca3068c3eba0f42e5debbb30938f61d250f3ff975
SHA512395dbb4ba7e888356d1b926e29f2ac1650411588d510270d17db4928c6aef26083477aabf34e38d30ac504f939271866a0509eb56d60115ef42940252e4f956e
-
memory/900-65-0x0000000000000000-mapping.dmp
-
memory/1516-71-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1516-69-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1516-80-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1516-78-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/1516-72-0x0000000000089A6B-mapping.dmp
-
memory/1632-77-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/1632-74-0x00000000008BB000-0x00000000008CC000-memory.dmpFilesize
68KB
-
memory/1692-61-0x0000000000000000-mapping.dmp
-
memory/1716-62-0x0000000000000000-mapping.dmp
-
memory/1724-59-0x0000000000000000-mapping.dmp
-
memory/1868-63-0x0000000000000000-mapping.dmp
-
memory/1896-55-0x0000000000000000-mapping.dmp
-
memory/2016-67-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2016-66-0x00000000002EB000-0x00000000002FC000-memory.dmpFilesize
68KB
-
memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/2016-57-0x00000000001B0000-0x00000000001C3000-memory.dmpFilesize
76KB
-
memory/2016-58-0x0000000000400000-0x000000000070B000-memory.dmpFilesize
3.0MB
-
memory/2016-56-0x00000000002EB000-0x00000000002FC000-memory.dmpFilesize
68KB