Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 04:40
Static task
static1
Behavioral task
behavioral1
Sample
c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe
Resource
win10v2004-20240226-en
General
-
Target
c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe
-
Size
11.5MB
-
MD5
c4ffcd2bd37b1c2d3152f4bbde0a0d6a
-
SHA1
0139695f29932d6a4ca7f04c6cb9a42dbfeeca70
-
SHA256
0ed2549b5144673e94c79df078daa20e3a07b8d90edcd7422bafe216512bedca
-
SHA512
d6e24017484c9781c31646c41f1b7307b7a8c2755201e894a15d0e620e1384be9e5b0862873f7271f5481fb7b9ad2b37804f07b1133ed512b7a5cc7da81d91c1
-
SSDEEP
24576:1Uqa71YB5DHlommmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmW:1F15
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4240 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\zhemkkvr\ImagePath = "C:\\Windows\\SysWOW64\\zhemkkvr\\narasfhb.exe" narasfhb.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe -
Deletes itself 1 IoCs
pid Process 3360 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 220 narasfhb.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 220 set thread context of 3360 220 narasfhb.exe 110 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4500 sc.exe 716 sc.exe 4352 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 2916 5060 WerFault.exe 85 1148 220 WerFault.exe 106 -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 5060 wrote to memory of 312 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 89 PID 5060 wrote to memory of 312 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 89 PID 5060 wrote to memory of 312 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 89 PID 5060 wrote to memory of 4576 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 93 PID 5060 wrote to memory of 4576 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 93 PID 5060 wrote to memory of 4576 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 93 PID 5060 wrote to memory of 4500 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 95 PID 5060 wrote to memory of 4500 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 95 PID 5060 wrote to memory of 4500 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 95 PID 5060 wrote to memory of 716 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 98 PID 5060 wrote to memory of 716 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 98 PID 5060 wrote to memory of 716 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 98 PID 5060 wrote to memory of 4352 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 101 PID 5060 wrote to memory of 4352 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 101 PID 5060 wrote to memory of 4352 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 101 PID 5060 wrote to memory of 4240 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 103 PID 5060 wrote to memory of 4240 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 103 PID 5060 wrote to memory of 4240 5060 c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe 103 PID 220 wrote to memory of 3360 220 narasfhb.exe 110 PID 220 wrote to memory of 3360 220 narasfhb.exe 110 PID 220 wrote to memory of 3360 220 narasfhb.exe 110 PID 220 wrote to memory of 3360 220 narasfhb.exe 110 PID 220 wrote to memory of 3360 220 narasfhb.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe"C:\Users\Admin\AppData\Local\Temp\c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\zhemkkvr\2⤵PID:312
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\narasfhb.exe" C:\Windows\SysWOW64\zhemkkvr\2⤵PID:4576
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create zhemkkvr binPath= "C:\Windows\SysWOW64\zhemkkvr\narasfhb.exe /d\"C:\Users\Admin\AppData\Local\Temp\c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:4500
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description zhemkkvr "wifi internet conection"2⤵
- Launches sc.exe
PID:716
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start zhemkkvr2⤵
- Launches sc.exe
PID:4352
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:4240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 10402⤵
- Program crash
PID:2916
-
-
C:\Windows\SysWOW64\zhemkkvr\narasfhb.exeC:\Windows\SysWOW64\zhemkkvr\narasfhb.exe /d"C:\Users\Admin\AppData\Local\Temp\c4ffcd2bd37b1c2d3152f4bbde0a0d6a.exe"1⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Deletes itself
PID:3360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 5162⤵
- Program crash
PID:1148
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5060 -ip 50601⤵PID:2516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 220 -ip 2201⤵PID:5008
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.5MB
MD5f9ba22ca44a319cc7e4434e0ed266d73
SHA1b363a6a9d97c0c0b69ec0d0d6e0f6ecaa7a594ae
SHA25671ea6712ed6e0b5f117f8435ce4bf489c6af6e651fa47346f2b093183d04e750
SHA51242cac07e5415596e647f1942d3d14faa5b788f172a71e1790e82568080b8f0eae4886f44a0f9b37659df6ea67302c4ad16e9f781f50c792c7e71bb7385e7079a