Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/10/2023, 12:48

General

  • Target

    file.exe

  • Size

    284KB

  • MD5

    d1de288c58de023e8aad492868da3b92

  • SHA1

    530d8675705fee02d103c076706585f8f7a97de2

  • SHA256

    ead20c77e005c89bcc2a699892caa8775d7a7aa2c15d5170fd3d4b783f8f3ee3

  • SHA512

    9179f17800fe35a816c3dc29a6d936e56658f253b83fac6c396cad5fd2f8c2c4e0beb62013c4d2625e13a5ba9ba7332f5bbadb6702eb441cc1a07e995365906e

  • SSDEEP

    3072:FcSalqHSwBWbacDEgFAdpW1Z8AZLJDAM/a9:taYlWeeEucpCZZZq

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1324
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xqdjbrqs\
      2⤵
        PID:2396
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ehalluvv.exe" C:\Windows\SysWOW64\xqdjbrqs\
        2⤵
          PID:3728
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create xqdjbrqs binPath= "C:\Windows\SysWOW64\xqdjbrqs\ehalluvv.exe /d\"C:\Users\Admin\AppData\Local\Temp\file.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:3032
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description xqdjbrqs "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:1284
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start xqdjbrqs
          2⤵
          • Launches sc.exe
          PID:2264
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:3424
      • C:\Windows\SysWOW64\xqdjbrqs\ehalluvv.exe
        C:\Windows\SysWOW64\xqdjbrqs\ehalluvv.exe /d"C:\Users\Admin\AppData\Local\Temp\file.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4748
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:4800
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
        1⤵
          PID:3400
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k UnistackSvcGroup
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1824

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\ehalluvv.exe

          Filesize

          11.5MB

          MD5

          92a1efbab01ddf1367b14e4fb9ccc197

          SHA1

          62c78306d11ba19ea5c5f0cdf56fc1d967f58927

          SHA256

          22c522ea0b91d14078bbf0bd1eca99e9142951b46eee04d258c6d7881efe83d5

          SHA512

          4a97e8a98fa7594d0144eb310067e736e1f5af3fb4bf6a9d472a727e1577e8fd165312e6324894c4e2662e3925a1ccdd12ab4bc0caefffd2165aaea1dc232243

        • C:\Windows\SysWOW64\xqdjbrqs\ehalluvv.exe

          Filesize

          11.5MB

          MD5

          92a1efbab01ddf1367b14e4fb9ccc197

          SHA1

          62c78306d11ba19ea5c5f0cdf56fc1d967f58927

          SHA256

          22c522ea0b91d14078bbf0bd1eca99e9142951b46eee04d258c6d7881efe83d5

          SHA512

          4a97e8a98fa7594d0144eb310067e736e1f5af3fb4bf6a9d472a727e1577e8fd165312e6324894c4e2662e3925a1ccdd12ab4bc0caefffd2165aaea1dc232243

        • memory/1324-2-0x0000000003FD0000-0x0000000003FE3000-memory.dmp

          Filesize

          76KB

        • memory/1324-4-0x0000000000400000-0x0000000002284000-memory.dmp

          Filesize

          30.5MB

        • memory/1324-7-0x0000000000400000-0x0000000002284000-memory.dmp

          Filesize

          30.5MB

        • memory/1324-8-0x0000000003FD0000-0x0000000003FE3000-memory.dmp

          Filesize

          76KB

        • memory/1324-1-0x00000000022E0000-0x00000000023E0000-memory.dmp

          Filesize

          1024KB

        • memory/1824-76-0x000001A0BB340000-0x000001A0BB350000-memory.dmp

          Filesize

          64KB

        • memory/1824-60-0x000001A0BB240000-0x000001A0BB250000-memory.dmp

          Filesize

          64KB

        • memory/4748-15-0x0000000000400000-0x0000000002284000-memory.dmp

          Filesize

          30.5MB

        • memory/4748-10-0x0000000002430000-0x0000000002530000-memory.dmp

          Filesize

          1024KB

        • memory/4748-16-0x0000000000400000-0x0000000002284000-memory.dmp

          Filesize

          30.5MB

        • memory/4800-32-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-39-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-20-0x0000000000A50000-0x0000000000A65000-memory.dmp

          Filesize

          84KB

        • memory/4800-21-0x0000000002600000-0x000000000280F000-memory.dmp

          Filesize

          2.1MB

        • memory/4800-24-0x0000000002600000-0x000000000280F000-memory.dmp

          Filesize

          2.1MB

        • memory/4800-25-0x0000000002910000-0x0000000002916000-memory.dmp

          Filesize

          24KB

        • memory/4800-28-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-31-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-17-0x0000000000A50000-0x0000000000A65000-memory.dmp

          Filesize

          84KB

        • memory/4800-34-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-36-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-35-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-33-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-37-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-38-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-18-0x0000000000A50000-0x0000000000A65000-memory.dmp

          Filesize

          84KB

        • memory/4800-40-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-41-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-42-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-43-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-45-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-44-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-46-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-47-0x0000000002920000-0x0000000002930000-memory.dmp

          Filesize

          64KB

        • memory/4800-48-0x0000000002BF0000-0x0000000002BF5000-memory.dmp

          Filesize

          20KB

        • memory/4800-51-0x0000000002BF0000-0x0000000002BF5000-memory.dmp

          Filesize

          20KB

        • memory/4800-52-0x0000000007600000-0x0000000007A0B000-memory.dmp

          Filesize

          4.0MB

        • memory/4800-55-0x0000000007600000-0x0000000007A0B000-memory.dmp

          Filesize

          4.0MB

        • memory/4800-56-0x0000000007B50000-0x0000000007B57000-memory.dmp

          Filesize

          28KB

        • memory/4800-14-0x0000000000A50000-0x0000000000A65000-memory.dmp

          Filesize

          84KB

        • memory/4800-11-0x0000000000A50000-0x0000000000A65000-memory.dmp

          Filesize

          84KB