Analysis
-
max time kernel
166s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 10:10
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
350KB
-
MD5
e6c5a231ec3235d5020f4af44ee5f2b8
-
SHA1
ae7aeaf37397c4adf15eb839f3a69b0b64444e9f
-
SHA256
72ddf1a00d4705c99c0d26668d6af55071dcddeb9c4da47f87e5c69dc1ef3e19
-
SHA512
367668d17178bb47ab49afdd7d9ff73682cca7872920e587592f739b55805f056b3f93613bff6d359f84f4c0d18c6bc9ac461d30998dce865130ebec50380692
-
SSDEEP
6144:KHXLG/6QDZw2FGxTKrzXR8+zqrWuRjMgU:K3S/DK2sYzXR8/RQg
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\nhnhoikc = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
ihghisux.exepid process 1892 ihghisux.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\nhnhoikc\ImagePath = "C:\\Windows\\SysWOW64\\nhnhoikc\\ihghisux.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 592 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ihghisux.exedescription pid process target process PID 1892 set thread context of 592 1892 ihghisux.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1288 sc.exe 2036 sc.exe 736 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
file.exeihghisux.exedescription pid process target process PID 892 wrote to memory of 1236 892 file.exe cmd.exe PID 892 wrote to memory of 1236 892 file.exe cmd.exe PID 892 wrote to memory of 1236 892 file.exe cmd.exe PID 892 wrote to memory of 1236 892 file.exe cmd.exe PID 892 wrote to memory of 1420 892 file.exe cmd.exe PID 892 wrote to memory of 1420 892 file.exe cmd.exe PID 892 wrote to memory of 1420 892 file.exe cmd.exe PID 892 wrote to memory of 1420 892 file.exe cmd.exe PID 892 wrote to memory of 1288 892 file.exe sc.exe PID 892 wrote to memory of 1288 892 file.exe sc.exe PID 892 wrote to memory of 1288 892 file.exe sc.exe PID 892 wrote to memory of 1288 892 file.exe sc.exe PID 892 wrote to memory of 2036 892 file.exe sc.exe PID 892 wrote to memory of 2036 892 file.exe sc.exe PID 892 wrote to memory of 2036 892 file.exe sc.exe PID 892 wrote to memory of 2036 892 file.exe sc.exe PID 892 wrote to memory of 736 892 file.exe sc.exe PID 892 wrote to memory of 736 892 file.exe sc.exe PID 892 wrote to memory of 736 892 file.exe sc.exe PID 892 wrote to memory of 736 892 file.exe sc.exe PID 892 wrote to memory of 428 892 file.exe netsh.exe PID 892 wrote to memory of 428 892 file.exe netsh.exe PID 892 wrote to memory of 428 892 file.exe netsh.exe PID 892 wrote to memory of 428 892 file.exe netsh.exe PID 1892 wrote to memory of 592 1892 ihghisux.exe svchost.exe PID 1892 wrote to memory of 592 1892 ihghisux.exe svchost.exe PID 1892 wrote to memory of 592 1892 ihghisux.exe svchost.exe PID 1892 wrote to memory of 592 1892 ihghisux.exe svchost.exe PID 1892 wrote to memory of 592 1892 ihghisux.exe svchost.exe PID 1892 wrote to memory of 592 1892 ihghisux.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\nhnhoikc\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ihghisux.exe" C:\Windows\SysWOW64\nhnhoikc\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create nhnhoikc binPath= "C:\Windows\SysWOW64\nhnhoikc\ihghisux.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description nhnhoikc "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start nhnhoikc2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\nhnhoikc\ihghisux.exeC:\Windows\SysWOW64\nhnhoikc\ihghisux.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ihghisux.exeFilesize
13.7MB
MD5d1d47983cfa48dfee16d6b569b454d6f
SHA1f64ae2a053ee34631e7c6b9a20dcec4579867734
SHA2569d8050efe82922e8c737832814c6771c949a0b80936b4479640526083638b903
SHA512b96eddf213d520c5437b7a6a0f978473aefa90ce2b9f5f817f5a07d34476b253d38711c6e9b8065e7c070d3d62d5b381a590d0847e6b793784bb5c211ebda61c
-
C:\Windows\SysWOW64\nhnhoikc\ihghisux.exeFilesize
13.7MB
MD5d1d47983cfa48dfee16d6b569b454d6f
SHA1f64ae2a053ee34631e7c6b9a20dcec4579867734
SHA2569d8050efe82922e8c737832814c6771c949a0b80936b4479640526083638b903
SHA512b96eddf213d520c5437b7a6a0f978473aefa90ce2b9f5f817f5a07d34476b253d38711c6e9b8065e7c070d3d62d5b381a590d0847e6b793784bb5c211ebda61c
-
memory/428-65-0x0000000000000000-mapping.dmp
-
memory/592-72-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/592-80-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/592-79-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/592-73-0x0000000000089A6B-mapping.dmp
-
memory/592-70-0x0000000000080000-0x0000000000095000-memory.dmpFilesize
84KB
-
memory/736-63-0x0000000000000000-mapping.dmp
-
memory/892-66-0x000000000061A000-0x000000000062F000-memory.dmpFilesize
84KB
-
memory/892-57-0x0000000000020000-0x0000000000033000-memory.dmpFilesize
76KB
-
memory/892-56-0x000000000061A000-0x000000000062F000-memory.dmpFilesize
84KB
-
memory/892-67-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/892-54-0x0000000075141000-0x0000000075143000-memory.dmpFilesize
8KB
-
memory/892-58-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/1236-55-0x0000000000000000-mapping.dmp
-
memory/1288-61-0x0000000000000000-mapping.dmp
-
memory/1420-59-0x0000000000000000-mapping.dmp
-
memory/1892-76-0x000000000056A000-0x000000000057F000-memory.dmpFilesize
84KB
-
memory/1892-77-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/2036-62-0x0000000000000000-mapping.dmp