Analysis
-
max time kernel
143s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
deed33d8537ad5384cd927b88df28494.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
deed33d8537ad5384cd927b88df28494.exe
Resource
win10v2004-20240226-en
General
-
Target
deed33d8537ad5384cd927b88df28494.exe
-
Size
12.1MB
-
MD5
deed33d8537ad5384cd927b88df28494
-
SHA1
49586c8d73492b95d4cc2eb77db1c43b664cb534
-
SHA256
6eaff3a3059d64fba8aaf22757cd51de82addb4f84f24f87aa3292a95d0825ca
-
SHA512
26be2d580be0f355f6c6f2a2bb0d8b913d178bda678a36480ddae95ca85ffa64a2fd8e1a8017c07ef5ba03ea8a1d0d4b6d2134d508d6f740e93db8c551ccbcea
-
SSDEEP
49152:zyqI2kmso555555555555555555555555555555555555555555555555555555T:zyqI2
Malware Config
Extracted
tofsee
43.231.4.7
lazystax.ru
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ymqshkno = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2444 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ymqshkno\ImagePath = "C:\\Windows\\SysWOW64\\ymqshkno\\hbbsdmdf.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2992 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2428 hbbsdmdf.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2428 set thread context of 2992 2428 hbbsdmdf.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2624 sc.exe 2552 sc.exe 2756 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1436 wrote to memory of 3056 1436 deed33d8537ad5384cd927b88df28494.exe 28 PID 1436 wrote to memory of 3056 1436 deed33d8537ad5384cd927b88df28494.exe 28 PID 1436 wrote to memory of 3056 1436 deed33d8537ad5384cd927b88df28494.exe 28 PID 1436 wrote to memory of 3056 1436 deed33d8537ad5384cd927b88df28494.exe 28 PID 1436 wrote to memory of 2516 1436 deed33d8537ad5384cd927b88df28494.exe 30 PID 1436 wrote to memory of 2516 1436 deed33d8537ad5384cd927b88df28494.exe 30 PID 1436 wrote to memory of 2516 1436 deed33d8537ad5384cd927b88df28494.exe 30 PID 1436 wrote to memory of 2516 1436 deed33d8537ad5384cd927b88df28494.exe 30 PID 1436 wrote to memory of 2624 1436 deed33d8537ad5384cd927b88df28494.exe 32 PID 1436 wrote to memory of 2624 1436 deed33d8537ad5384cd927b88df28494.exe 32 PID 1436 wrote to memory of 2624 1436 deed33d8537ad5384cd927b88df28494.exe 32 PID 1436 wrote to memory of 2624 1436 deed33d8537ad5384cd927b88df28494.exe 32 PID 1436 wrote to memory of 2552 1436 deed33d8537ad5384cd927b88df28494.exe 34 PID 1436 wrote to memory of 2552 1436 deed33d8537ad5384cd927b88df28494.exe 34 PID 1436 wrote to memory of 2552 1436 deed33d8537ad5384cd927b88df28494.exe 34 PID 1436 wrote to memory of 2552 1436 deed33d8537ad5384cd927b88df28494.exe 34 PID 1436 wrote to memory of 2756 1436 deed33d8537ad5384cd927b88df28494.exe 36 PID 1436 wrote to memory of 2756 1436 deed33d8537ad5384cd927b88df28494.exe 36 PID 1436 wrote to memory of 2756 1436 deed33d8537ad5384cd927b88df28494.exe 36 PID 1436 wrote to memory of 2756 1436 deed33d8537ad5384cd927b88df28494.exe 36 PID 1436 wrote to memory of 2444 1436 deed33d8537ad5384cd927b88df28494.exe 38 PID 1436 wrote to memory of 2444 1436 deed33d8537ad5384cd927b88df28494.exe 38 PID 1436 wrote to memory of 2444 1436 deed33d8537ad5384cd927b88df28494.exe 38 PID 1436 wrote to memory of 2444 1436 deed33d8537ad5384cd927b88df28494.exe 38 PID 2428 wrote to memory of 2992 2428 hbbsdmdf.exe 41 PID 2428 wrote to memory of 2992 2428 hbbsdmdf.exe 41 PID 2428 wrote to memory of 2992 2428 hbbsdmdf.exe 41 PID 2428 wrote to memory of 2992 2428 hbbsdmdf.exe 41 PID 2428 wrote to memory of 2992 2428 hbbsdmdf.exe 41 PID 2428 wrote to memory of 2992 2428 hbbsdmdf.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ymqshkno\2⤵PID:3056
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hbbsdmdf.exe" C:\Windows\SysWOW64\ymqshkno\2⤵PID:2516
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ymqshkno binPath= "C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe /d\"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2624
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ymqshkno "wifi internet conection"2⤵
- Launches sc.exe
PID:2552
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ymqshkno2⤵
- Launches sc.exe
PID:2756
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2444
-
-
C:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exeC:\Windows\SysWOW64\ymqshkno\hbbsdmdf.exe /d"C:\Users\Admin\AppData\Local\Temp\deed33d8537ad5384cd927b88df28494.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.4MB
MD599942c7c9d05ab4ceb75ca3880952cc3
SHA15bbe60343821535132ec1c0382f34299459c2ded
SHA256efc7a37e4f2a33a07b9f2bcc223ca6942c9e5ea6dac5fe0d724b0a474c853edc
SHA512e53013dd7d2abc899a71e8fc620b6675be2685873607182868c2806cc753eb355e850190ffe0c81e6293987a96d3eb68d0f5a26c7f7ef7f29f60957052e00a60
-
Filesize
4.3MB
MD5d3518cfce049a078c5d7d454f45f18ff
SHA1c9a2a92a0d093fbe96fa331ad6f0187de278fadc
SHA256a994d077bddd69c283ac3df4688089118696dc22f994dc368a59e610651695fa
SHA51236cd6fe78146d0a11c0192413c0b358de2080ffd28aa602f339fb153bacc9cbbcf8428d0cd5ffac353a995715899b7c40dc5b0d9e17c91663a8206b2d2f6a86e