Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 15:43
Static task
static1
Behavioral task
behavioral1
Sample
de5da42d2a492730c54beb78daf4a683.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
de5da42d2a492730c54beb78daf4a683.exe
Resource
win10v2004-20240226-en
General
-
Target
de5da42d2a492730c54beb78daf4a683.exe
-
Size
11.3MB
-
MD5
de5da42d2a492730c54beb78daf4a683
-
SHA1
5831d3343907e0720285f1c155bdfde80d6ffbf1
-
SHA256
d9491f47925462566a31712bc2ff372b2038c1e0c06765c6acc6df1eb1db3d79
-
SHA512
24feaf2db924b0c9f69ee2bd152c12250d40b4d81759a5c8f6182e8db077d7403e5e5d28738d17457f44ccdcd236a9c0ed24a0c0b70d1a044f3dcb93352e9c07
-
SSDEEP
24576:VMbR/TEq/Z/3RIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIr:VcE8
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\aqfghorx = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2300 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\aqfghorx\ImagePath = "C:\\Windows\\SysWOW64\\aqfghorx\\bvrxiskq.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2744 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2592 bvrxiskq.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2592 set thread context of 2744 2592 bvrxiskq.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2732 sc.exe 2032 sc.exe 2568 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2940 wrote to memory of 3056 2940 de5da42d2a492730c54beb78daf4a683.exe 28 PID 2940 wrote to memory of 3056 2940 de5da42d2a492730c54beb78daf4a683.exe 28 PID 2940 wrote to memory of 3056 2940 de5da42d2a492730c54beb78daf4a683.exe 28 PID 2940 wrote to memory of 3056 2940 de5da42d2a492730c54beb78daf4a683.exe 28 PID 2940 wrote to memory of 2356 2940 de5da42d2a492730c54beb78daf4a683.exe 30 PID 2940 wrote to memory of 2356 2940 de5da42d2a492730c54beb78daf4a683.exe 30 PID 2940 wrote to memory of 2356 2940 de5da42d2a492730c54beb78daf4a683.exe 30 PID 2940 wrote to memory of 2356 2940 de5da42d2a492730c54beb78daf4a683.exe 30 PID 2940 wrote to memory of 2032 2940 de5da42d2a492730c54beb78daf4a683.exe 32 PID 2940 wrote to memory of 2032 2940 de5da42d2a492730c54beb78daf4a683.exe 32 PID 2940 wrote to memory of 2032 2940 de5da42d2a492730c54beb78daf4a683.exe 32 PID 2940 wrote to memory of 2032 2940 de5da42d2a492730c54beb78daf4a683.exe 32 PID 2940 wrote to memory of 2568 2940 de5da42d2a492730c54beb78daf4a683.exe 34 PID 2940 wrote to memory of 2568 2940 de5da42d2a492730c54beb78daf4a683.exe 34 PID 2940 wrote to memory of 2568 2940 de5da42d2a492730c54beb78daf4a683.exe 34 PID 2940 wrote to memory of 2568 2940 de5da42d2a492730c54beb78daf4a683.exe 34 PID 2940 wrote to memory of 2732 2940 de5da42d2a492730c54beb78daf4a683.exe 36 PID 2940 wrote to memory of 2732 2940 de5da42d2a492730c54beb78daf4a683.exe 36 PID 2940 wrote to memory of 2732 2940 de5da42d2a492730c54beb78daf4a683.exe 36 PID 2940 wrote to memory of 2732 2940 de5da42d2a492730c54beb78daf4a683.exe 36 PID 2940 wrote to memory of 2300 2940 de5da42d2a492730c54beb78daf4a683.exe 39 PID 2940 wrote to memory of 2300 2940 de5da42d2a492730c54beb78daf4a683.exe 39 PID 2940 wrote to memory of 2300 2940 de5da42d2a492730c54beb78daf4a683.exe 39 PID 2940 wrote to memory of 2300 2940 de5da42d2a492730c54beb78daf4a683.exe 39 PID 2592 wrote to memory of 2744 2592 bvrxiskq.exe 41 PID 2592 wrote to memory of 2744 2592 bvrxiskq.exe 41 PID 2592 wrote to memory of 2744 2592 bvrxiskq.exe 41 PID 2592 wrote to memory of 2744 2592 bvrxiskq.exe 41 PID 2592 wrote to memory of 2744 2592 bvrxiskq.exe 41 PID 2592 wrote to memory of 2744 2592 bvrxiskq.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\de5da42d2a492730c54beb78daf4a683.exe"C:\Users\Admin\AppData\Local\Temp\de5da42d2a492730c54beb78daf4a683.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\aqfghorx\2⤵PID:3056
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\bvrxiskq.exe" C:\Windows\SysWOW64\aqfghorx\2⤵PID:2356
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create aqfghorx binPath= "C:\Windows\SysWOW64\aqfghorx\bvrxiskq.exe /d\"C:\Users\Admin\AppData\Local\Temp\de5da42d2a492730c54beb78daf4a683.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2032
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description aqfghorx "wifi internet conection"2⤵
- Launches sc.exe
PID:2568
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start aqfghorx2⤵
- Launches sc.exe
PID:2732
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2300
-
-
C:\Windows\SysWOW64\aqfghorx\bvrxiskq.exeC:\Windows\SysWOW64\aqfghorx\bvrxiskq.exe /d"C:\Users\Admin\AppData\Local\Temp\de5da42d2a492730c54beb78daf4a683.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2744
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.3MB
MD52c4b9af5af82837125f462b8a11541b0
SHA1e60ffc065d744f725f7de7f842a88e4dad400802
SHA256ac064ffdf74d0ead32fb54e70a9552624f93edd12f30c9bd5aceaf550a292fc5
SHA512b6ead5bfdac0a4e6472cbfc22aafdd300e2646821618584beab6e69ff93d81fbb9e3e6e3f25068c23127797b923e95fde815174368e1d32c4f1426fbbcaec14c
-
Filesize
10.2MB
MD53a8ea167a4dbba41f464312a1b2c5fb5
SHA1d9544826f82d0c7a5647fe209bf9c0988888bff8
SHA25692ccf111bdff9f8944b304da9677819393a8743fec175976e229483d066e11e4
SHA512f57e5945b8da60a4726af7a4f014907a527c193a1c4746b9ef62fcd0ff7855a7707b1da9a10aed333032a180d21722edb2aeaa31556a490ca64add30491fdb68