Analysis
-
max time kernel
166s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 02:01
Static task
static1
Behavioral task
behavioral1
Sample
0afa588af16c7068fbae1ae4e46900a2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0afa588af16c7068fbae1ae4e46900a2.exe
Resource
win10v2004-20231215-en
General
-
Target
0afa588af16c7068fbae1ae4e46900a2.exe
-
Size
14.2MB
-
MD5
0afa588af16c7068fbae1ae4e46900a2
-
SHA1
07ae83b98f7bce0dbccd8c28db4accc2de760337
-
SHA256
e43c1d14f40e2d57fb222fc937a8c007c89ccdae9d1fd6b20cbc02c987c9c442
-
SHA512
f3341ca41c682718b47fcc89215d0accfd412ad3a4e7c83d0465c5b8a6e2d5bc41ec797b2dc0010a66296852cdb067f3ab9db7c08ea2f0d4e46ded63bfc62ebf
-
SSDEEP
49152:zlGypVbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbn:zlGyp
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 3716 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\dzfwihuc\ImagePath = "C:\\Windows\\SysWOW64\\dzfwihuc\\qhdkbaei.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 0afa588af16c7068fbae1ae4e46900a2.exe -
Executes dropped EXE 1 IoCs
pid Process 1884 qhdkbaei.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1884 set thread context of 1624 1884 qhdkbaei.exe 111 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5044 sc.exe 1576 sc.exe 4940 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1720 1884 WerFault.exe 110 876 3888 WerFault.exe 91 -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3888 wrote to memory of 212 3888 0afa588af16c7068fbae1ae4e46900a2.exe 97 PID 3888 wrote to memory of 212 3888 0afa588af16c7068fbae1ae4e46900a2.exe 97 PID 3888 wrote to memory of 212 3888 0afa588af16c7068fbae1ae4e46900a2.exe 97 PID 3888 wrote to memory of 3512 3888 0afa588af16c7068fbae1ae4e46900a2.exe 98 PID 3888 wrote to memory of 3512 3888 0afa588af16c7068fbae1ae4e46900a2.exe 98 PID 3888 wrote to memory of 3512 3888 0afa588af16c7068fbae1ae4e46900a2.exe 98 PID 3888 wrote to memory of 5044 3888 0afa588af16c7068fbae1ae4e46900a2.exe 101 PID 3888 wrote to memory of 5044 3888 0afa588af16c7068fbae1ae4e46900a2.exe 101 PID 3888 wrote to memory of 5044 3888 0afa588af16c7068fbae1ae4e46900a2.exe 101 PID 3888 wrote to memory of 1576 3888 0afa588af16c7068fbae1ae4e46900a2.exe 103 PID 3888 wrote to memory of 1576 3888 0afa588af16c7068fbae1ae4e46900a2.exe 103 PID 3888 wrote to memory of 1576 3888 0afa588af16c7068fbae1ae4e46900a2.exe 103 PID 3888 wrote to memory of 4940 3888 0afa588af16c7068fbae1ae4e46900a2.exe 105 PID 3888 wrote to memory of 4940 3888 0afa588af16c7068fbae1ae4e46900a2.exe 105 PID 3888 wrote to memory of 4940 3888 0afa588af16c7068fbae1ae4e46900a2.exe 105 PID 3888 wrote to memory of 3716 3888 0afa588af16c7068fbae1ae4e46900a2.exe 107 PID 3888 wrote to memory of 3716 3888 0afa588af16c7068fbae1ae4e46900a2.exe 107 PID 3888 wrote to memory of 3716 3888 0afa588af16c7068fbae1ae4e46900a2.exe 107 PID 1884 wrote to memory of 1624 1884 qhdkbaei.exe 111 PID 1884 wrote to memory of 1624 1884 qhdkbaei.exe 111 PID 1884 wrote to memory of 1624 1884 qhdkbaei.exe 111 PID 1884 wrote to memory of 1624 1884 qhdkbaei.exe 111 PID 1884 wrote to memory of 1624 1884 qhdkbaei.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\0afa588af16c7068fbae1ae4e46900a2.exe"C:\Users\Admin\AppData\Local\Temp\0afa588af16c7068fbae1ae4e46900a2.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dzfwihuc\2⤵PID:212
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\qhdkbaei.exe" C:\Windows\SysWOW64\dzfwihuc\2⤵PID:3512
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create dzfwihuc binPath= "C:\Windows\SysWOW64\dzfwihuc\qhdkbaei.exe /d\"C:\Users\Admin\AppData\Local\Temp\0afa588af16c7068fbae1ae4e46900a2.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:5044
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description dzfwihuc "wifi internet conection"2⤵
- Launches sc.exe
PID:1576
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start dzfwihuc2⤵
- Launches sc.exe
PID:4940
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:3716
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 12642⤵
- Program crash
PID:876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3888 -ip 38881⤵PID:3140
-
C:\Windows\SysWOW64\dzfwihuc\qhdkbaei.exeC:\Windows\SysWOW64\dzfwihuc\qhdkbaei.exe /d"C:\Users\Admin\AppData\Local\Temp\0afa588af16c7068fbae1ae4e46900a2.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
PID:1624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 5242⤵
- Program crash
PID:1720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1884 -ip 18841⤵PID:4636
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.3MB
MD5de419e8e87c23a31864ec7c8dd28a0ba
SHA138a280b87e43a09abe70528995d8d5e6d4088036
SHA256b4ead4d0187af71a356e05a4989d5522b7f84a3c5791f47b9f5f88ae4a2734a7
SHA5126633d7938499d49921378fcbe099b2273cb0e385687d7572708fdffef2d0328fc3476aa0be509302359cefb9b34bfd610d1b44c40fc3042b31c45c5a2257e1f5