Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
26-11-2022 09:06
Static task
static1
Behavioral task
behavioral1
Sample
662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe
Resource
win10-20220812-en
General
-
Target
662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe
-
Size
146KB
-
MD5
1fd5ff320a44cfc6d33a505c24efa590
-
SHA1
6db5b5667f7861e163344f95ec9f0f3616d14130
-
SHA256
662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08
-
SHA512
83177f1f72249deaca68249ee5b2f4b755dd0481fb7b24c55f3f28183d5b54edf40f4e330bb00156210eea1f6d73414474df4f3b5b8b69cb14150d058983c29d
-
SSDEEP
3072:/EBurucqyxil650IRnGOamWe3BYL7aoBUSl3X:cVcqd6Bg7aj+n
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\cxwgcnxa = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
jzbofxi.exepid process 1772 jzbofxi.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\cxwgcnxa\ImagePath = "C:\\Windows\\SysWOW64\\cxwgcnxa\\jzbofxi.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 4804 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
jzbofxi.exedescription pid process target process PID 1772 set thread context of 4804 1772 jzbofxi.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 3656 sc.exe 4044 sc.exe 4228 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exejzbofxi.exedescription pid process target process PID 1000 wrote to memory of 3780 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe cmd.exe PID 1000 wrote to memory of 3780 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe cmd.exe PID 1000 wrote to memory of 3780 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe cmd.exe PID 1000 wrote to memory of 2008 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe cmd.exe PID 1000 wrote to memory of 2008 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe cmd.exe PID 1000 wrote to memory of 2008 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe cmd.exe PID 1000 wrote to memory of 3656 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe sc.exe PID 1000 wrote to memory of 3656 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe sc.exe PID 1000 wrote to memory of 3656 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe sc.exe PID 1000 wrote to memory of 4044 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe sc.exe PID 1000 wrote to memory of 4044 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe sc.exe PID 1000 wrote to memory of 4044 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe sc.exe PID 1000 wrote to memory of 4228 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe sc.exe PID 1000 wrote to memory of 4228 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe sc.exe PID 1000 wrote to memory of 4228 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe sc.exe PID 1000 wrote to memory of 4548 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe netsh.exe PID 1000 wrote to memory of 4548 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe netsh.exe PID 1000 wrote to memory of 4548 1000 662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe netsh.exe PID 1772 wrote to memory of 4804 1772 jzbofxi.exe svchost.exe PID 1772 wrote to memory of 4804 1772 jzbofxi.exe svchost.exe PID 1772 wrote to memory of 4804 1772 jzbofxi.exe svchost.exe PID 1772 wrote to memory of 4804 1772 jzbofxi.exe svchost.exe PID 1772 wrote to memory of 4804 1772 jzbofxi.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe"C:\Users\Admin\AppData\Local\Temp\662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\cxwgcnxa\2⤵PID:3780
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\jzbofxi.exe" C:\Windows\SysWOW64\cxwgcnxa\2⤵PID:2008
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create cxwgcnxa binPath= "C:\Windows\SysWOW64\cxwgcnxa\jzbofxi.exe /d\"C:\Users\Admin\AppData\Local\Temp\662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:3656 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description cxwgcnxa "wifi internet conection"2⤵
- Launches sc.exe
PID:4044 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start cxwgcnxa2⤵
- Launches sc.exe
PID:4228 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:4548
-
C:\Windows\SysWOW64\cxwgcnxa\jzbofxi.exeC:\Windows\SysWOW64\cxwgcnxa\jzbofxi.exe /d"C:\Users\Admin\AppData\Local\Temp\662a375950d1b16ceb51ea7d50fbaa9121f087d7d148d3be65705a2c4b8b3d08.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:4804
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\jzbofxi.exeFilesize
11.1MB
MD5f61982b30a755155a8f36450ad8acbf7
SHA133bd48cb076af9f17780fa9ffb54389126e5ff4d
SHA256473132c661a90f39aba24d9741a4c015cdafda23caf746e82af12a12a243f6cc
SHA512e32adbf75874d9c80c522eb1d5f7cd0b4681ad658f35b6b461d260363010f2c05deb3bd96d92a0cccdf7c1d36bc95ebaa84926d1bacfd29d6f222e385fe3a898
-
C:\Windows\SysWOW64\cxwgcnxa\jzbofxi.exeFilesize
11.1MB
MD5f61982b30a755155a8f36450ad8acbf7
SHA133bd48cb076af9f17780fa9ffb54389126e5ff4d
SHA256473132c661a90f39aba24d9741a4c015cdafda23caf746e82af12a12a243f6cc
SHA512e32adbf75874d9c80c522eb1d5f7cd0b4681ad658f35b6b461d260363010f2c05deb3bd96d92a0cccdf7c1d36bc95ebaa84926d1bacfd29d6f222e385fe3a898
-
memory/1000-161-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-155-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-124-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-125-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-126-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-127-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-128-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-129-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-130-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-131-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-132-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-133-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-134-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-135-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-136-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-165-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-138-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-139-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-140-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-141-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-143-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-144-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-145-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-146-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-147-0x0000000000AE0000-0x0000000000B8E000-memory.dmpFilesize
696KB
-
memory/1000-148-0x0000000002810000-0x0000000002823000-memory.dmpFilesize
76KB
-
memory/1000-149-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-150-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-151-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-152-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-153-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-154-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-164-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-156-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-157-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-158-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-159-0x0000000000400000-0x0000000000AD6000-memory.dmpFilesize
6.8MB
-
memory/1000-160-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-163-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-162-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-120-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-123-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-137-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-166-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-167-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-168-0x0000000000AE0000-0x0000000000B8E000-memory.dmpFilesize
696KB
-
memory/1000-169-0x0000000002810000-0x0000000002823000-memory.dmpFilesize
76KB
-
memory/1000-170-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-171-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-172-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-121-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1000-225-0x0000000000400000-0x0000000000AD6000-memory.dmpFilesize
6.8MB
-
memory/1000-122-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/1772-308-0x0000000000AE0000-0x0000000000B8E000-memory.dmpFilesize
696KB
-
memory/1772-310-0x0000000000400000-0x0000000000AD6000-memory.dmpFilesize
6.8MB
-
memory/2008-180-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2008-179-0x0000000000000000-mapping.dmp
-
memory/2008-184-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2008-181-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2008-182-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/2008-183-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3656-188-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3656-194-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3656-192-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3656-189-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3656-190-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3656-186-0x0000000000000000-mapping.dmp
-
memory/3656-187-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3780-175-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3780-176-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3780-178-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3780-173-0x0000000000000000-mapping.dmp
-
memory/3780-177-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/3780-174-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/4044-193-0x0000000077DE0000-0x0000000077F6E000-memory.dmpFilesize
1.6MB
-
memory/4044-191-0x0000000000000000-mapping.dmp
-
memory/4228-208-0x0000000000000000-mapping.dmp
-
memory/4548-219-0x0000000000000000-mapping.dmp
-
memory/4804-489-0x0000000002D20000-0x0000000002D35000-memory.dmpFilesize
84KB
-
memory/4804-304-0x0000000002D29A6B-mapping.dmp
-
memory/4804-372-0x0000000002D20000-0x0000000002D35000-memory.dmpFilesize
84KB