Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/03/2024, 07:36
Static task
static1
Behavioral task
behavioral1
Sample
c55440db0a749fe01816496b4aea5656.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
c55440db0a749fe01816496b4aea5656.exe
Resource
win10v2004-20240226-en
General
-
Target
c55440db0a749fe01816496b4aea5656.exe
-
Size
13.9MB
-
MD5
c55440db0a749fe01816496b4aea5656
-
SHA1
b8310b4fb9e13cb55d35407b7d7f8d8ea109b934
-
SHA256
eb5ad872fce2860c2f6f83a6ee8966ad99c3603f8ece08657415160d163b9647
-
SHA512
10eaabbd5c9550e78fcc125a58170bfddf29dc03e1f4180b3db6ec70e8b85003724d54554e892c8b56414c9af5c8d3fef85818b317366c8d3547af195bd04dc7
-
SSDEEP
24576:RjDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/:Rnh
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1696 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\apjadpmr\ImagePath = "C:\\Windows\\SysWOW64\\apjadpmr\\wfnlegjj.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation c55440db0a749fe01816496b4aea5656.exe -
Executes dropped EXE 1 IoCs
pid Process 4028 wfnlegjj.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4028 set thread context of 1236 4028 wfnlegjj.exe 107 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4928 sc.exe 1364 sc.exe 4960 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 996 wrote to memory of 3484 996 c55440db0a749fe01816496b4aea5656.exe 92 PID 996 wrote to memory of 3484 996 c55440db0a749fe01816496b4aea5656.exe 92 PID 996 wrote to memory of 3484 996 c55440db0a749fe01816496b4aea5656.exe 92 PID 996 wrote to memory of 1748 996 c55440db0a749fe01816496b4aea5656.exe 94 PID 996 wrote to memory of 1748 996 c55440db0a749fe01816496b4aea5656.exe 94 PID 996 wrote to memory of 1748 996 c55440db0a749fe01816496b4aea5656.exe 94 PID 996 wrote to memory of 4928 996 c55440db0a749fe01816496b4aea5656.exe 96 PID 996 wrote to memory of 4928 996 c55440db0a749fe01816496b4aea5656.exe 96 PID 996 wrote to memory of 4928 996 c55440db0a749fe01816496b4aea5656.exe 96 PID 996 wrote to memory of 1364 996 c55440db0a749fe01816496b4aea5656.exe 98 PID 996 wrote to memory of 1364 996 c55440db0a749fe01816496b4aea5656.exe 98 PID 996 wrote to memory of 1364 996 c55440db0a749fe01816496b4aea5656.exe 98 PID 996 wrote to memory of 4960 996 c55440db0a749fe01816496b4aea5656.exe 102 PID 996 wrote to memory of 4960 996 c55440db0a749fe01816496b4aea5656.exe 102 PID 996 wrote to memory of 4960 996 c55440db0a749fe01816496b4aea5656.exe 102 PID 996 wrote to memory of 1696 996 c55440db0a749fe01816496b4aea5656.exe 105 PID 996 wrote to memory of 1696 996 c55440db0a749fe01816496b4aea5656.exe 105 PID 996 wrote to memory of 1696 996 c55440db0a749fe01816496b4aea5656.exe 105 PID 4028 wrote to memory of 1236 4028 wfnlegjj.exe 107 PID 4028 wrote to memory of 1236 4028 wfnlegjj.exe 107 PID 4028 wrote to memory of 1236 4028 wfnlegjj.exe 107 PID 4028 wrote to memory of 1236 4028 wfnlegjj.exe 107 PID 4028 wrote to memory of 1236 4028 wfnlegjj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c55440db0a749fe01816496b4aea5656.exe"C:\Users\Admin\AppData\Local\Temp\c55440db0a749fe01816496b4aea5656.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\apjadpmr\2⤵PID:3484
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wfnlegjj.exe" C:\Windows\SysWOW64\apjadpmr\2⤵PID:1748
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create apjadpmr binPath= "C:\Windows\SysWOW64\apjadpmr\wfnlegjj.exe /d\"C:\Users\Admin\AppData\Local\Temp\c55440db0a749fe01816496b4aea5656.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:4928
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description apjadpmr "wifi internet conection"2⤵
- Launches sc.exe
PID:1364
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start apjadpmr2⤵
- Launches sc.exe
PID:4960
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:1696
-
-
C:\Windows\SysWOW64\apjadpmr\wfnlegjj.exeC:\Windows\SysWOW64\apjadpmr\wfnlegjj.exe /d"C:\Users\Admin\AppData\Local\Temp\c55440db0a749fe01816496b4aea5656.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
PID:1236
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.0MB
MD508bfdfe7b7e767ad2991a7fc48228bec
SHA157dafdf658952e4ed2c3945572a10a19654d0814
SHA2564c8846586dcc03d751099a1e4d4fe70b78289d0bc1764f01c55063c84c3ae15f
SHA512dde800be49d17d2cdbdf6367c4f48ee012fc60cbbb7c32ce8139523b326fab9c45ae3618ac7042c77b3d16991eb4c3dd24db25ea7f42362017d83d0552bd1aaa