Analysis
-
max time kernel
53s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 22:06
Static task
static1
Behavioral task
behavioral1
Sample
cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe
Resource
win7-20221111-en
General
-
Target
cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe
-
Size
192KB
-
MD5
d4e0a9ff19277f89090ea5e4e558f7ef
-
SHA1
cd3a22ef3f2a0a4f3b01b95b13c4946045e0cd63
-
SHA256
cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796
-
SHA512
585d62799f6fe5ce68018c20e8aecb6154959bfb8fc02a69dd9a3b249f94f85c1600d60cb2b74365fe4426de4f172fbc0df7e7e789bb06386895eb7bdf1241be
-
SSDEEP
3072:9rbR6e6hM46gUIJ5qbMlCzgyQ4Iu0mE4GrtmxRs9E3AZxpR/c:9Mc46gUL4Bg01xxvp
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
ryycdnxi.exepid process 1544 ryycdnxi.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ryycdnxi.exedescription pid process target process PID 1544 set thread context of 1648 1544 ryycdnxi.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 696 sc.exe 384 sc.exe 1888 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exeryycdnxi.exedescription pid process target process PID 1664 wrote to memory of 896 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe cmd.exe PID 1664 wrote to memory of 896 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe cmd.exe PID 1664 wrote to memory of 896 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe cmd.exe PID 1664 wrote to memory of 896 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe cmd.exe PID 1664 wrote to memory of 520 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe cmd.exe PID 1664 wrote to memory of 520 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe cmd.exe PID 1664 wrote to memory of 520 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe cmd.exe PID 1664 wrote to memory of 520 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe cmd.exe PID 1664 wrote to memory of 696 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 696 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 696 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 696 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 384 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 384 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 384 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 384 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 1888 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 1888 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 1888 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1664 wrote to memory of 1888 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe sc.exe PID 1544 wrote to memory of 1648 1544 ryycdnxi.exe svchost.exe PID 1544 wrote to memory of 1648 1544 ryycdnxi.exe svchost.exe PID 1544 wrote to memory of 1648 1544 ryycdnxi.exe svchost.exe PID 1544 wrote to memory of 1648 1544 ryycdnxi.exe svchost.exe PID 1664 wrote to memory of 1644 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe netsh.exe PID 1664 wrote to memory of 1644 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe netsh.exe PID 1664 wrote to memory of 1644 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe netsh.exe PID 1664 wrote to memory of 1644 1664 cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe netsh.exe PID 1544 wrote to memory of 1648 1544 ryycdnxi.exe svchost.exe PID 1544 wrote to memory of 1648 1544 ryycdnxi.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe"C:\Users\Admin\AppData\Local\Temp\cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gxuzzfyy\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ryycdnxi.exe" C:\Windows\SysWOW64\gxuzzfyy\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create gxuzzfyy binPath= "C:\Windows\SysWOW64\gxuzzfyy\ryycdnxi.exe /d\"C:\Users\Admin\AppData\Local\Temp\cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description gxuzzfyy "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start gxuzzfyy2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\gxuzzfyy\ryycdnxi.exeC:\Windows\SysWOW64\gxuzzfyy\ryycdnxi.exe /d"C:\Users\Admin\AppData\Local\Temp\cd524a9867b1196e9fd5103acdfa12b3a8b79b7469bf4eb36fce62d35c375796.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ryycdnxi.exeFilesize
12.0MB
MD56b1be3387d26e8227c4507580057f7e8
SHA11ca746a93f5415c7cfd190d6229485ff8167b1e6
SHA256874ce72876dc1828b8273751877634fdb57c4315f8c8f4869df9aa75f1249a67
SHA512b67d94d0fa2861326b32c1dfbbfb561dd67f9a001f75c6864ed2f1bab1a6984c8f60018e5ca8ec1739ee7ece3fe3e855890fde972a7ebc0a85d4832908a92ce5
-
C:\Windows\SysWOW64\gxuzzfyy\ryycdnxi.exeFilesize
12.0MB
MD56b1be3387d26e8227c4507580057f7e8
SHA11ca746a93f5415c7cfd190d6229485ff8167b1e6
SHA256874ce72876dc1828b8273751877634fdb57c4315f8c8f4869df9aa75f1249a67
SHA512b67d94d0fa2861326b32c1dfbbfb561dd67f9a001f75c6864ed2f1bab1a6984c8f60018e5ca8ec1739ee7ece3fe3e855890fde972a7ebc0a85d4832908a92ce5
-
memory/384-62-0x0000000000000000-mapping.dmp
-
memory/520-59-0x0000000000000000-mapping.dmp
-
memory/696-61-0x0000000000000000-mapping.dmp
-
memory/896-57-0x0000000000000000-mapping.dmp
-
memory/1544-67-0x00000000002E0000-0x00000000002F3000-memory.dmpFilesize
76KB
-
memory/1544-78-0x00000000005FB000-0x000000000060C000-memory.dmpFilesize
68KB
-
memory/1544-79-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1544-68-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1544-66-0x00000000005FB000-0x000000000060C000-memory.dmpFilesize
68KB
-
memory/1644-71-0x0000000000000000-mapping.dmp
-
memory/1648-72-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/1648-69-0x00000000000C0000-0x00000000000D5000-memory.dmpFilesize
84KB
-
memory/1648-73-0x00000000000C9A6B-mapping.dmp
-
memory/1664-55-0x00000000002B0000-0x00000000002C3000-memory.dmpFilesize
76KB
-
memory/1664-58-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1664-74-0x000000000050B000-0x000000000051C000-memory.dmpFilesize
68KB
-
memory/1664-76-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/1664-56-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/1664-54-0x000000000050B000-0x000000000051C000-memory.dmpFilesize
68KB
-
memory/1888-63-0x0000000000000000-mapping.dmp