Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
19/11/2023, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe
Resource
win10v2004-20231023-en
General
-
Target
f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe
-
Size
265KB
-
MD5
695c14c51ae9ff59157cf69f97b2d1cc
-
SHA1
4688eea11efa5c61c7704b5ca80196eb9099e867
-
SHA256
f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1
-
SHA512
e43e45420544f2fd736f2427443941f1da5b8d4a74d4c9d2e0a95c8306b2f10e12beaa6b0c2ec2715ecbd66b41431f404c942c32720a8b3ee2afa640657d4688
-
SSDEEP
3072:d6LaowspCAE+mYgDxv5l7Iek5Ym7IQoiteVFWbVD22WsgAsR6c7ovb3TQh9:SaWCAF5Cf7Iem57InitGMxycQMrT
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4576 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe -
Executes dropped EXE 1 IoCs
pid Process 2300 bnvsylrp.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3884 sc.exe 4644 sc.exe 2116 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1812 4444 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4444 wrote to memory of 2500 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 103 PID 4444 wrote to memory of 2500 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 103 PID 4444 wrote to memory of 2500 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 103 PID 4444 wrote to memory of 3924 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 105 PID 4444 wrote to memory of 3924 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 105 PID 4444 wrote to memory of 3924 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 105 PID 4444 wrote to memory of 3884 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 107 PID 4444 wrote to memory of 3884 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 107 PID 4444 wrote to memory of 3884 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 107 PID 4444 wrote to memory of 4644 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 109 PID 4444 wrote to memory of 4644 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 109 PID 4444 wrote to memory of 4644 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 109 PID 4444 wrote to memory of 2116 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 111 PID 4444 wrote to memory of 2116 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 111 PID 4444 wrote to memory of 2116 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 111 PID 4444 wrote to memory of 4576 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 114 PID 4444 wrote to memory of 4576 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 114 PID 4444 wrote to memory of 4576 4444 f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe"C:\Users\Admin\AppData\Local\Temp\f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mjnmkpjc\2⤵PID:2500
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bnvsylrp.exe" C:\Windows\SysWOW64\mjnmkpjc\2⤵PID:3924
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create mjnmkpjc binPath= "C:\Windows\SysWOW64\mjnmkpjc\bnvsylrp.exe /d\"C:\Users\Admin\AppData\Local\Temp\f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:3884
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description mjnmkpjc "wifi internet conection"2⤵
- Launches sc.exe
PID:4644
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start mjnmkpjc2⤵
- Launches sc.exe
PID:2116
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:4576
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 12042⤵
- Program crash
PID:1812
-
-
C:\Windows\SysWOW64\mjnmkpjc\bnvsylrp.exeC:\Windows\SysWOW64\mjnmkpjc\bnvsylrp.exe /d"C:\Users\Admin\AppData\Local\Temp\f2b4ea5a8678e6b4ff70b238e34a208f4287f113ba6a65c12592a01cf9cf17c1.exe"1⤵
- Executes dropped EXE
PID:2300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4444 -ip 44441⤵PID:4528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.0MB
MD52da10fc09a391f14a73c782698479c6d
SHA1f0db4556aea9f4e26396c9f908089f0a81a33ef9
SHA256b5a8de64a754131ef86339c210414ac59f45c1db9f854bd00d6c74601877ada9
SHA51266f14443059c06a254718fde8384cb9db8dfc412a312845df1d8297dbc1922cf4d0cf7f045c61dddb5b27fbec27aaf753f44a37054ab676e3e283d11b0292135
-
Filesize
14.0MB
MD52da10fc09a391f14a73c782698479c6d
SHA1f0db4556aea9f4e26396c9f908089f0a81a33ef9
SHA256b5a8de64a754131ef86339c210414ac59f45c1db9f854bd00d6c74601877ada9
SHA51266f14443059c06a254718fde8384cb9db8dfc412a312845df1d8297dbc1922cf4d0cf7f045c61dddb5b27fbec27aaf753f44a37054ab676e3e283d11b0292135