Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
a2adb7966f88e6c0e15a8f5a04404fcf.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a2adb7966f88e6c0e15a8f5a04404fcf.exe
Resource
win10v2004-20231215-en
General
-
Target
a2adb7966f88e6c0e15a8f5a04404fcf.exe
-
Size
12.5MB
-
MD5
a2adb7966f88e6c0e15a8f5a04404fcf
-
SHA1
b208879afed8bb3bfe5882891363bbed3d1d94af
-
SHA256
3cb6cffbee2f03febb5c5ffc0e6b6f7d06e184ee69c6d873bc4619fe4ebfcce7
-
SHA512
d19acf346d6433e2c1f500bb6ed8c1b021f299eea18ae987220f2ca6baa678cfb4a06e65df9c6136d9f0e41459557b52a73e34449f0d18e6b76d3762bf23c97f
-
SSDEEP
98304:DNWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllH:hW
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ziyvzfpp = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2636 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ziyvzfpp\ImagePath = "C:\\Windows\\SysWOW64\\ziyvzfpp\\ygvzmktt.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2756 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2664 ygvzmktt.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2664 set thread context of 2756 2664 ygvzmktt.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2260 sc.exe 2532 sc.exe 2632 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2416 wrote to memory of 1996 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 28 PID 2416 wrote to memory of 1996 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 28 PID 2416 wrote to memory of 1996 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 28 PID 2416 wrote to memory of 1996 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 28 PID 2416 wrote to memory of 2764 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 30 PID 2416 wrote to memory of 2764 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 30 PID 2416 wrote to memory of 2764 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 30 PID 2416 wrote to memory of 2764 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 30 PID 2416 wrote to memory of 2260 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 33 PID 2416 wrote to memory of 2260 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 33 PID 2416 wrote to memory of 2260 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 33 PID 2416 wrote to memory of 2260 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 33 PID 2416 wrote to memory of 2532 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 35 PID 2416 wrote to memory of 2532 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 35 PID 2416 wrote to memory of 2532 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 35 PID 2416 wrote to memory of 2532 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 35 PID 2416 wrote to memory of 2632 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 37 PID 2416 wrote to memory of 2632 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 37 PID 2416 wrote to memory of 2632 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 37 PID 2416 wrote to memory of 2632 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 37 PID 2416 wrote to memory of 2636 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 40 PID 2416 wrote to memory of 2636 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 40 PID 2416 wrote to memory of 2636 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 40 PID 2416 wrote to memory of 2636 2416 a2adb7966f88e6c0e15a8f5a04404fcf.exe 40 PID 2664 wrote to memory of 2756 2664 ygvzmktt.exe 41 PID 2664 wrote to memory of 2756 2664 ygvzmktt.exe 41 PID 2664 wrote to memory of 2756 2664 ygvzmktt.exe 41 PID 2664 wrote to memory of 2756 2664 ygvzmktt.exe 41 PID 2664 wrote to memory of 2756 2664 ygvzmktt.exe 41 PID 2664 wrote to memory of 2756 2664 ygvzmktt.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2adb7966f88e6c0e15a8f5a04404fcf.exe"C:\Users\Admin\AppData\Local\Temp\a2adb7966f88e6c0e15a8f5a04404fcf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ziyvzfpp\2⤵PID:1996
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ygvzmktt.exe" C:\Windows\SysWOW64\ziyvzfpp\2⤵PID:2764
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ziyvzfpp binPath= "C:\Windows\SysWOW64\ziyvzfpp\ygvzmktt.exe /d\"C:\Users\Admin\AppData\Local\Temp\a2adb7966f88e6c0e15a8f5a04404fcf.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2260
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ziyvzfpp "wifi internet conection"2⤵
- Launches sc.exe
PID:2532
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ziyvzfpp2⤵
- Launches sc.exe
PID:2632
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2636
-
-
C:\Windows\SysWOW64\ziyvzfpp\ygvzmktt.exeC:\Windows\SysWOW64\ziyvzfpp\ygvzmktt.exe /d"C:\Users\Admin\AppData\Local\Temp\a2adb7966f88e6c0e15a8f5a04404fcf.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2756
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD5ac6d1876a306a54c19def1c8e257a8b9
SHA1d960ba60e7b55e263143df239ae9f7b42dab73cf
SHA25666ee251bbcbaacdf9062897c83e38e02fe331631b041caf6c03379744a7dd8b0
SHA512a7c87cacd14dd1184156b6f554c7793faf638b2dac471474d1651ea101ca53711950fa0bfe1bdb487704d29c9d1efb94119d99180ee2cc0ccb0697cfb22dcf2a
-
Filesize
93KB
MD5ea96e0346a6397f0459f83ca458841a7
SHA1a979ce56ca0dbde04e0ec77b94c143fc4e7c3872
SHA256154fbfb86c78f728df08893f8dfaf0e866d15ece0e2f53f6dc54bee82097ddf2
SHA512994fcdc9466110944f1404da13d6e6c62f26eb61567b0fe8b142d9e2a15cc10dc88e3776e5b51f0f85805460867a40ca7d385ae48f92c5902a093f7692fceaf1