Analysis
-
max time kernel
144s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08-05-2023 06:45
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
General
-
Target
file.exe
-
Size
298KB
-
MD5
b7c137a18093f43fa0ac50865cc34f9c
-
SHA1
93727de39d92f6934d4ddee26728b207a212428e
-
SHA256
63e235b92d97d6c3d5a5dca42f31279b674d3140affc1e26c5971d12fc1d7667
-
SHA512
40683347b6f3dd2f18d15d5bfaa64d98f6ca88d1497bac811483366c59e5c786914dd32445981f774666b20053390f18d5a01f278162ba85bf75866edf6c95d6
-
SSDEEP
3072:/UgGk8D2CKiH+U3XmE5kDOXkqVDE/zpUp+rqdyy76kgREiwUP7A6qVxWm5iT/Hrq:Ret/X/GDwpELm04B710Ej2qVA8i
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\egajzugr = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\egajzugr\ImagePath = "C:\\Windows\\SysWOW64\\egajzugr\\ugsxuazn.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1212 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
ugsxuazn.exepid process 984 ugsxuazn.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ugsxuazn.exedescription pid process target process PID 984 set thread context of 1212 984 ugsxuazn.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 1252 sc.exe 976 sc.exe 524 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
file.exeugsxuazn.exedescription pid process target process PID 1260 wrote to memory of 1576 1260 file.exe cmd.exe PID 1260 wrote to memory of 1576 1260 file.exe cmd.exe PID 1260 wrote to memory of 1576 1260 file.exe cmd.exe PID 1260 wrote to memory of 1576 1260 file.exe cmd.exe PID 1260 wrote to memory of 1556 1260 file.exe cmd.exe PID 1260 wrote to memory of 1556 1260 file.exe cmd.exe PID 1260 wrote to memory of 1556 1260 file.exe cmd.exe PID 1260 wrote to memory of 1556 1260 file.exe cmd.exe PID 1260 wrote to memory of 976 1260 file.exe sc.exe PID 1260 wrote to memory of 976 1260 file.exe sc.exe PID 1260 wrote to memory of 976 1260 file.exe sc.exe PID 1260 wrote to memory of 976 1260 file.exe sc.exe PID 1260 wrote to memory of 524 1260 file.exe sc.exe PID 1260 wrote to memory of 524 1260 file.exe sc.exe PID 1260 wrote to memory of 524 1260 file.exe sc.exe PID 1260 wrote to memory of 524 1260 file.exe sc.exe PID 1260 wrote to memory of 1252 1260 file.exe sc.exe PID 1260 wrote to memory of 1252 1260 file.exe sc.exe PID 1260 wrote to memory of 1252 1260 file.exe sc.exe PID 1260 wrote to memory of 1252 1260 file.exe sc.exe PID 1260 wrote to memory of 768 1260 file.exe netsh.exe PID 1260 wrote to memory of 768 1260 file.exe netsh.exe PID 1260 wrote to memory of 768 1260 file.exe netsh.exe PID 1260 wrote to memory of 768 1260 file.exe netsh.exe PID 984 wrote to memory of 1212 984 ugsxuazn.exe svchost.exe PID 984 wrote to memory of 1212 984 ugsxuazn.exe svchost.exe PID 984 wrote to memory of 1212 984 ugsxuazn.exe svchost.exe PID 984 wrote to memory of 1212 984 ugsxuazn.exe svchost.exe PID 984 wrote to memory of 1212 984 ugsxuazn.exe svchost.exe PID 984 wrote to memory of 1212 984 ugsxuazn.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\egajzugr\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ugsxuazn.exe" C:\Windows\SysWOW64\egajzugr\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create egajzugr binPath= "C:\Windows\SysWOW64\egajzugr\ugsxuazn.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description egajzugr "wifi internet conection"2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start egajzugr2⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\egajzugr\ugsxuazn.exeC:\Windows\SysWOW64\egajzugr\ugsxuazn.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ugsxuazn.exeFilesize
13.0MB
MD5f9c9ceef7fcd2c3e9c3dc53e36a3f6e9
SHA1cfacc91d727a11a5537c17d980fa0704e128d1ef
SHA25647457f5cfc94fb88a89dec270768e6048ab6270dae366f037d612abd6a638989
SHA512f973a14c9ba127859f1caad927ded0e6d87e5a4690d5334f26e62a1825d50c154a03002894e7629ccefee5698617c9a597e072eec9c68d8dae4699cd3a0ba2c9
-
C:\Windows\SysWOW64\egajzugr\ugsxuazn.exeFilesize
13.0MB
MD5f9c9ceef7fcd2c3e9c3dc53e36a3f6e9
SHA1cfacc91d727a11a5537c17d980fa0704e128d1ef
SHA25647457f5cfc94fb88a89dec270768e6048ab6270dae366f037d612abd6a638989
SHA512f973a14c9ba127859f1caad927ded0e6d87e5a4690d5334f26e62a1825d50c154a03002894e7629ccefee5698617c9a597e072eec9c68d8dae4699cd3a0ba2c9
-
memory/984-65-0x0000000000400000-0x00000000006C8000-memory.dmpFilesize
2.8MB
-
memory/1212-61-0x0000000000090000-0x00000000000A5000-memory.dmpFilesize
84KB
-
memory/1212-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1212-63-0x0000000000090000-0x00000000000A5000-memory.dmpFilesize
84KB
-
memory/1212-67-0x0000000000090000-0x00000000000A5000-memory.dmpFilesize
84KB
-
memory/1212-68-0x0000000000090000-0x00000000000A5000-memory.dmpFilesize
84KB
-
memory/1212-69-0x0000000000090000-0x00000000000A5000-memory.dmpFilesize
84KB
-
memory/1212-70-0x0000000000090000-0x00000000000A5000-memory.dmpFilesize
84KB
-
memory/1260-56-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/1260-59-0x0000000000400000-0x00000000006C8000-memory.dmpFilesize
2.8MB