Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
de4b82a7ffeafcc4720ea974858808fd.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
de4b82a7ffeafcc4720ea974858808fd.exe
Resource
win10v2004-20240319-en
General
-
Target
de4b82a7ffeafcc4720ea974858808fd.exe
-
Size
12.5MB
-
MD5
de4b82a7ffeafcc4720ea974858808fd
-
SHA1
5fe3e02097b77dc5696e5c70c73c86beeec1653d
-
SHA256
ef25242cd655ccffe910bec6a1625773d929fb0bc657a8af0a72442af126c7b1
-
SHA512
474fd7aa6edfa92e13656c1bfd835f0f9b9905c2ae0c0d6766ade1c08b6449e90d95ae921c3fd2ce2ba7dc6ecc5c0a08507f86ea3be6c5847d5db8fc58b2265d
-
SSDEEP
24576:TjCj10HSqGgeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/:T/D
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\osywdkhm = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2644 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\osywdkhm\ImagePath = "C:\\Windows\\SysWOW64\\osywdkhm\\lpwacfvh.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2540 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2052 lpwacfvh.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2052 set thread context of 2540 2052 lpwacfvh.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2496 sc.exe 2512 sc.exe 2620 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3020 wrote to memory of 1692 3020 de4b82a7ffeafcc4720ea974858808fd.exe 28 PID 3020 wrote to memory of 1692 3020 de4b82a7ffeafcc4720ea974858808fd.exe 28 PID 3020 wrote to memory of 1692 3020 de4b82a7ffeafcc4720ea974858808fd.exe 28 PID 3020 wrote to memory of 1692 3020 de4b82a7ffeafcc4720ea974858808fd.exe 28 PID 3020 wrote to memory of 2252 3020 de4b82a7ffeafcc4720ea974858808fd.exe 30 PID 3020 wrote to memory of 2252 3020 de4b82a7ffeafcc4720ea974858808fd.exe 30 PID 3020 wrote to memory of 2252 3020 de4b82a7ffeafcc4720ea974858808fd.exe 30 PID 3020 wrote to memory of 2252 3020 de4b82a7ffeafcc4720ea974858808fd.exe 30 PID 3020 wrote to memory of 2496 3020 de4b82a7ffeafcc4720ea974858808fd.exe 32 PID 3020 wrote to memory of 2496 3020 de4b82a7ffeafcc4720ea974858808fd.exe 32 PID 3020 wrote to memory of 2496 3020 de4b82a7ffeafcc4720ea974858808fd.exe 32 PID 3020 wrote to memory of 2496 3020 de4b82a7ffeafcc4720ea974858808fd.exe 32 PID 3020 wrote to memory of 2512 3020 de4b82a7ffeafcc4720ea974858808fd.exe 34 PID 3020 wrote to memory of 2512 3020 de4b82a7ffeafcc4720ea974858808fd.exe 34 PID 3020 wrote to memory of 2512 3020 de4b82a7ffeafcc4720ea974858808fd.exe 34 PID 3020 wrote to memory of 2512 3020 de4b82a7ffeafcc4720ea974858808fd.exe 34 PID 3020 wrote to memory of 2620 3020 de4b82a7ffeafcc4720ea974858808fd.exe 36 PID 3020 wrote to memory of 2620 3020 de4b82a7ffeafcc4720ea974858808fd.exe 36 PID 3020 wrote to memory of 2620 3020 de4b82a7ffeafcc4720ea974858808fd.exe 36 PID 3020 wrote to memory of 2620 3020 de4b82a7ffeafcc4720ea974858808fd.exe 36 PID 3020 wrote to memory of 2644 3020 de4b82a7ffeafcc4720ea974858808fd.exe 38 PID 3020 wrote to memory of 2644 3020 de4b82a7ffeafcc4720ea974858808fd.exe 38 PID 3020 wrote to memory of 2644 3020 de4b82a7ffeafcc4720ea974858808fd.exe 38 PID 3020 wrote to memory of 2644 3020 de4b82a7ffeafcc4720ea974858808fd.exe 38 PID 2052 wrote to memory of 2540 2052 lpwacfvh.exe 41 PID 2052 wrote to memory of 2540 2052 lpwacfvh.exe 41 PID 2052 wrote to memory of 2540 2052 lpwacfvh.exe 41 PID 2052 wrote to memory of 2540 2052 lpwacfvh.exe 41 PID 2052 wrote to memory of 2540 2052 lpwacfvh.exe 41 PID 2052 wrote to memory of 2540 2052 lpwacfvh.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\osywdkhm\2⤵PID:1692
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lpwacfvh.exe" C:\Windows\SysWOW64\osywdkhm\2⤵PID:2252
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create osywdkhm binPath= "C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe /d\"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2496
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description osywdkhm "wifi internet conection"2⤵
- Launches sc.exe
PID:2512
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start osywdkhm2⤵
- Launches sc.exe
PID:2620
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2644
-
-
C:\Windows\SysWOW64\osywdkhm\lpwacfvh.exeC:\Windows\SysWOW64\osywdkhm\lpwacfvh.exe /d"C:\Users\Admin\AppData\Local\Temp\de4b82a7ffeafcc4720ea974858808fd.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD5edf29686701f2c850340d956b4f7b241
SHA1c82e4490add55ccde7a12229d0c61e9cb77c9eaa
SHA25654044a0551c1f5810cdd6dd371855890d0478bbe4f652d54c1452d33781b3647
SHA5127c7d6436d3f69861bb2697314951498aa685e132601fd21c100f105ceda527b19abb552da4e55b02de788d3aab802061c3d8c36e4cfa5a644aaef8a9be0dbcd5
-
Filesize
14.8MB
MD5dfdfcbc34afa9d39dbe423373d6f83aa
SHA1b7dcea60759e86e7e3f41508643099a98d4bec41
SHA2562c724ed03fdfe4c9617d57b3d49875fac92c4c22c8c14da39bfcb06e7045795e
SHA51200315a14d7e3326097abe6e9b2ada52ad3cd1a518584891f41825480f23a50b71d103f616b4a7535a9bd8abfa5cde01106e470d9a642dd1c6d1fbc930c65caa6