Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 11:12

General

  • Target

    69ea6c1bae15f0e9a51c6d7645b92119.exe

  • Size

    13.0MB

  • MD5

    69ea6c1bae15f0e9a51c6d7645b92119

  • SHA1

    889d92a7c1728764aaa5d54cc134a113647f16b4

  • SHA256

    072ff816b2373bd6ab07298e3653d98c84b6a897ef17fc8002873edd9dff7e2e

  • SHA512

    51688cea0e7b75febda3617850401ae1813603fc543d96c67adb7ea08c5f470192dd25086ab8a30087dc32356171b6c8e5d48c3aaaefc80402826e33a376505c

  • SSDEEP

    24576:bgdy5yNM4444444444444444444444444444444444444444444444444444444g:

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 1 TTPs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69ea6c1bae15f0e9a51c6d7645b92119.exe
    "C:\Users\Admin\AppData\Local\Temp\69ea6c1bae15f0e9a51c6d7645b92119.exe"
    1⤵
      PID:4180
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\xnlszln\
        2⤵
          PID:4720
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ddwjvsrt.exe" C:\Windows\SysWOW64\xnlszln\
          2⤵
            PID:2208
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" create xnlszln binPath= "C:\Windows\SysWOW64\xnlszln\ddwjvsrt.exe /d\"C:\Users\Admin\AppData\Local\Temp\69ea6c1bae15f0e9a51c6d7645b92119.exe\"" type= own start= auto DisplayName= "wifi support"
            2⤵
            • Launches sc.exe
            PID:1564
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description xnlszln "wifi internet conection"
            2⤵
            • Launches sc.exe
            PID:2648
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" start xnlszln
            2⤵
            • Launches sc.exe
            PID:1996
          • C:\Windows\SysWOW64\netsh.exe
            "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
            2⤵
            • Modifies Windows Firewall
            PID:4980
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 1228
            2⤵
            • Program crash
            PID:2220
        • C:\Windows\SysWOW64\xnlszln\ddwjvsrt.exe
          C:\Windows\SysWOW64\xnlszln\ddwjvsrt.exe /d"C:\Users\Admin\AppData\Local\Temp\69ea6c1bae15f0e9a51c6d7645b92119.exe"
          1⤵
            PID:4528
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4528 -s 512
              2⤵
              • Program crash
              PID:4596
            • C:\Windows\SysWOW64\svchost.exe
              svchost.exe
              2⤵
                PID:3816
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4180 -ip 4180
              1⤵
                PID:2196
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4528 -ip 4528
                1⤵
                  PID:4380

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Windows\SysWOW64\xnlszln\ddwjvsrt.exe

                  Filesize

                  92KB

                  MD5

                  edcb268f9fefdd9145ae3b85ec74b5b4

                  SHA1

                  b211fc605bf72b8c196fa8ae6e4b45de1f9e29a2

                  SHA256

                  b2355d70b2c747c7ae0845a4654e89b3e8a32af9f134cbfcb00e1f4be9c99538

                  SHA512

                  ea5486a0050398058085418fa02c1ab0cac21945b19350f084a872b6502ee9e8ce68004b74e272bb9b40938085ca63c869556525f5702ceafc5c93b64888d300

                • memory/3816-15-0x0000000000AE0000-0x0000000000AF5000-memory.dmp

                  Filesize

                  84KB

                • memory/3816-18-0x0000000000AE0000-0x0000000000AF5000-memory.dmp

                  Filesize

                  84KB

                • memory/3816-16-0x0000000000AE0000-0x0000000000AF5000-memory.dmp

                  Filesize

                  84KB

                • memory/3816-12-0x0000000000AE0000-0x0000000000AF5000-memory.dmp

                  Filesize

                  84KB

                • memory/3816-19-0x0000000000AE0000-0x0000000000AF5000-memory.dmp

                  Filesize

                  84KB

                • memory/4180-1-0x0000000000460000-0x0000000000560000-memory.dmp

                  Filesize

                  1024KB

                • memory/4180-3-0x0000000000400000-0x0000000000456000-memory.dmp

                  Filesize

                  344KB

                • memory/4180-8-0x0000000000400000-0x0000000000456000-memory.dmp

                  Filesize

                  344KB

                • memory/4180-9-0x00000000021A0000-0x00000000021B3000-memory.dmp

                  Filesize

                  76KB

                • memory/4180-2-0x00000000021A0000-0x00000000021B3000-memory.dmp

                  Filesize

                  76KB

                • memory/4528-17-0x0000000000400000-0x0000000000456000-memory.dmp

                  Filesize

                  344KB

                • memory/4528-11-0x0000000000400000-0x0000000000456000-memory.dmp

                  Filesize

                  344KB

                • memory/4528-10-0x0000000000530000-0x0000000000630000-memory.dmp

                  Filesize

                  1024KB