Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 07:36
Static task
static1
Behavioral task
behavioral1
Sample
c55440db0a749fe01816496b4aea5656.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c55440db0a749fe01816496b4aea5656.exe
Resource
win10v2004-20240226-en
General
-
Target
c55440db0a749fe01816496b4aea5656.exe
-
Size
13.9MB
-
MD5
c55440db0a749fe01816496b4aea5656
-
SHA1
b8310b4fb9e13cb55d35407b7d7f8d8ea109b934
-
SHA256
eb5ad872fce2860c2f6f83a6ee8966ad99c3603f8ece08657415160d163b9647
-
SHA512
10eaabbd5c9550e78fcc125a58170bfddf29dc03e1f4180b3db6ec70e8b85003724d54554e892c8b56414c9af5c8d3fef85818b317366c8d3547af195bd04dc7
-
SSDEEP
24576:RjDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/:Rnh
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ajsksirw = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2412 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ajsksirw\ImagePath = "C:\\Windows\\SysWOW64\\ajsksirw\\bokaipku.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2388 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2408 bokaipku.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2408 set thread context of 2388 2408 bokaipku.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2168 sc.exe 2812 sc.exe 2488 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2916 2040 c55440db0a749fe01816496b4aea5656.exe 28 PID 2040 wrote to memory of 2916 2040 c55440db0a749fe01816496b4aea5656.exe 28 PID 2040 wrote to memory of 2916 2040 c55440db0a749fe01816496b4aea5656.exe 28 PID 2040 wrote to memory of 2916 2040 c55440db0a749fe01816496b4aea5656.exe 28 PID 2040 wrote to memory of 2580 2040 c55440db0a749fe01816496b4aea5656.exe 30 PID 2040 wrote to memory of 2580 2040 c55440db0a749fe01816496b4aea5656.exe 30 PID 2040 wrote to memory of 2580 2040 c55440db0a749fe01816496b4aea5656.exe 30 PID 2040 wrote to memory of 2580 2040 c55440db0a749fe01816496b4aea5656.exe 30 PID 2040 wrote to memory of 2168 2040 c55440db0a749fe01816496b4aea5656.exe 32 PID 2040 wrote to memory of 2168 2040 c55440db0a749fe01816496b4aea5656.exe 32 PID 2040 wrote to memory of 2168 2040 c55440db0a749fe01816496b4aea5656.exe 32 PID 2040 wrote to memory of 2168 2040 c55440db0a749fe01816496b4aea5656.exe 32 PID 2040 wrote to memory of 2812 2040 c55440db0a749fe01816496b4aea5656.exe 34 PID 2040 wrote to memory of 2812 2040 c55440db0a749fe01816496b4aea5656.exe 34 PID 2040 wrote to memory of 2812 2040 c55440db0a749fe01816496b4aea5656.exe 34 PID 2040 wrote to memory of 2812 2040 c55440db0a749fe01816496b4aea5656.exe 34 PID 2040 wrote to memory of 2488 2040 c55440db0a749fe01816496b4aea5656.exe 36 PID 2040 wrote to memory of 2488 2040 c55440db0a749fe01816496b4aea5656.exe 36 PID 2040 wrote to memory of 2488 2040 c55440db0a749fe01816496b4aea5656.exe 36 PID 2040 wrote to memory of 2488 2040 c55440db0a749fe01816496b4aea5656.exe 36 PID 2040 wrote to memory of 2412 2040 c55440db0a749fe01816496b4aea5656.exe 39 PID 2040 wrote to memory of 2412 2040 c55440db0a749fe01816496b4aea5656.exe 39 PID 2040 wrote to memory of 2412 2040 c55440db0a749fe01816496b4aea5656.exe 39 PID 2040 wrote to memory of 2412 2040 c55440db0a749fe01816496b4aea5656.exe 39 PID 2408 wrote to memory of 2388 2408 bokaipku.exe 41 PID 2408 wrote to memory of 2388 2408 bokaipku.exe 41 PID 2408 wrote to memory of 2388 2408 bokaipku.exe 41 PID 2408 wrote to memory of 2388 2408 bokaipku.exe 41 PID 2408 wrote to memory of 2388 2408 bokaipku.exe 41 PID 2408 wrote to memory of 2388 2408 bokaipku.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\c55440db0a749fe01816496b4aea5656.exe"C:\Users\Admin\AppData\Local\Temp\c55440db0a749fe01816496b4aea5656.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ajsksirw\2⤵PID:2916
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bokaipku.exe" C:\Windows\SysWOW64\ajsksirw\2⤵PID:2580
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ajsksirw binPath= "C:\Windows\SysWOW64\ajsksirw\bokaipku.exe /d\"C:\Users\Admin\AppData\Local\Temp\c55440db0a749fe01816496b4aea5656.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2168
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ajsksirw "wifi internet conection"2⤵
- Launches sc.exe
PID:2812
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ajsksirw2⤵
- Launches sc.exe
PID:2488
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2412
-
-
C:\Windows\SysWOW64\ajsksirw\bokaipku.exeC:\Windows\SysWOW64\ajsksirw\bokaipku.exe /d"C:\Users\Admin\AppData\Local\Temp\c55440db0a749fe01816496b4aea5656.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2388
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.6MB
MD5d482a790338406f8bf4ec94aa71a8447
SHA16352ae87db31694d5d0c9f8ef36dfe33cf7fdfba
SHA25684cca3f82382c161428f4c1bfa00034e907a0a45f715b30a2f1c5642de3cf960
SHA512fc38536cc83bdf1bb4a46896c3901d75c57569f128840b37aabd4d1dcafeeaaf4160bf20dd539a793e601d9ae2cf560a544d1f4d59dffa1e1e87bb29c2b33b33