Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
df22722085baaf84cd07e5d92b7ac69a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
df22722085baaf84cd07e5d92b7ac69a.exe
Resource
win10v2004-20240226-en
General
-
Target
df22722085baaf84cd07e5d92b7ac69a.exe
-
Size
10.5MB
-
MD5
df22722085baaf84cd07e5d92b7ac69a
-
SHA1
9be3215a254149267f6477c8e3e64d18aef0e38d
-
SHA256
e801ec0c491f33580b9474ab6e202b18f6952d48b69019a9c4ed48c279c5cf33
-
SHA512
c804dcc3643d69d1a4c330eafddd39e043584220d907d42e7dfeb353f5bc67e0fc0d1614e4e769b1d25b627cbe413369bb13e81243b3d25add5b8ad371589531
-
SSDEEP
49152:Z88888888888888888888888888888888888888888888888888888888888888f:
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\ixlsfvbf = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2548 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ixlsfvbf\ImagePath = "C:\\Windows\\SysWOW64\\ixlsfvbf\\pkzjotlj.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 652 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2468 pkzjotlj.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2468 set thread context of 652 2468 pkzjotlj.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2704 sc.exe 2528 sc.exe 2832 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3036 wrote to memory of 3032 3036 df22722085baaf84cd07e5d92b7ac69a.exe 28 PID 3036 wrote to memory of 3032 3036 df22722085baaf84cd07e5d92b7ac69a.exe 28 PID 3036 wrote to memory of 3032 3036 df22722085baaf84cd07e5d92b7ac69a.exe 28 PID 3036 wrote to memory of 3032 3036 df22722085baaf84cd07e5d92b7ac69a.exe 28 PID 3036 wrote to memory of 2620 3036 df22722085baaf84cd07e5d92b7ac69a.exe 30 PID 3036 wrote to memory of 2620 3036 df22722085baaf84cd07e5d92b7ac69a.exe 30 PID 3036 wrote to memory of 2620 3036 df22722085baaf84cd07e5d92b7ac69a.exe 30 PID 3036 wrote to memory of 2620 3036 df22722085baaf84cd07e5d92b7ac69a.exe 30 PID 3036 wrote to memory of 2704 3036 df22722085baaf84cd07e5d92b7ac69a.exe 32 PID 3036 wrote to memory of 2704 3036 df22722085baaf84cd07e5d92b7ac69a.exe 32 PID 3036 wrote to memory of 2704 3036 df22722085baaf84cd07e5d92b7ac69a.exe 32 PID 3036 wrote to memory of 2704 3036 df22722085baaf84cd07e5d92b7ac69a.exe 32 PID 3036 wrote to memory of 2528 3036 df22722085baaf84cd07e5d92b7ac69a.exe 34 PID 3036 wrote to memory of 2528 3036 df22722085baaf84cd07e5d92b7ac69a.exe 34 PID 3036 wrote to memory of 2528 3036 df22722085baaf84cd07e5d92b7ac69a.exe 34 PID 3036 wrote to memory of 2528 3036 df22722085baaf84cd07e5d92b7ac69a.exe 34 PID 3036 wrote to memory of 2832 3036 df22722085baaf84cd07e5d92b7ac69a.exe 36 PID 3036 wrote to memory of 2832 3036 df22722085baaf84cd07e5d92b7ac69a.exe 36 PID 3036 wrote to memory of 2832 3036 df22722085baaf84cd07e5d92b7ac69a.exe 36 PID 3036 wrote to memory of 2832 3036 df22722085baaf84cd07e5d92b7ac69a.exe 36 PID 3036 wrote to memory of 2548 3036 df22722085baaf84cd07e5d92b7ac69a.exe 38 PID 3036 wrote to memory of 2548 3036 df22722085baaf84cd07e5d92b7ac69a.exe 38 PID 3036 wrote to memory of 2548 3036 df22722085baaf84cd07e5d92b7ac69a.exe 38 PID 3036 wrote to memory of 2548 3036 df22722085baaf84cd07e5d92b7ac69a.exe 38 PID 2468 wrote to memory of 652 2468 pkzjotlj.exe 41 PID 2468 wrote to memory of 652 2468 pkzjotlj.exe 41 PID 2468 wrote to memory of 652 2468 pkzjotlj.exe 41 PID 2468 wrote to memory of 652 2468 pkzjotlj.exe 41 PID 2468 wrote to memory of 652 2468 pkzjotlj.exe 41 PID 2468 wrote to memory of 652 2468 pkzjotlj.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\df22722085baaf84cd07e5d92b7ac69a.exe"C:\Users\Admin\AppData\Local\Temp\df22722085baaf84cd07e5d92b7ac69a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ixlsfvbf\2⤵PID:3032
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pkzjotlj.exe" C:\Windows\SysWOW64\ixlsfvbf\2⤵PID:2620
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create ixlsfvbf binPath= "C:\Windows\SysWOW64\ixlsfvbf\pkzjotlj.exe /d\"C:\Users\Admin\AppData\Local\Temp\df22722085baaf84cd07e5d92b7ac69a.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2704
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description ixlsfvbf "wifi internet conection"2⤵
- Launches sc.exe
PID:2528
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start ixlsfvbf2⤵
- Launches sc.exe
PID:2832
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2548
-
-
C:\Windows\SysWOW64\ixlsfvbf\pkzjotlj.exeC:\Windows\SysWOW64\ixlsfvbf\pkzjotlj.exe /d"C:\Users\Admin\AppData\Local\Temp\df22722085baaf84cd07e5d92b7ac69a.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:652
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.3MB
MD5fe530ab617a30dd01218b5f2cc3a5cfd
SHA1ceea36060fb7f4b9b33cec3383935fc84cc7af8a
SHA256a9e652f019965eb1a797b369c72031072961acfe5db072f2024387a8de30c5e3
SHA5124d41c92a912e864b1ae0ecaffd6ee45fd383ef940634a8ce363694898f79e315ba1ebf71bf8b0927561b4b15dd527a0894a91d54d35b9f3e2ed1ecbfcac04f72
-
Filesize
1.2MB
MD5054bf43724b35d3cef24331dfeaefa3c
SHA13f8898e8964518164a14312c6112083ff8663663
SHA256b85ab20b7c88500e6d7657e0c4fb110ddec66ee02aa82aaca41573628a6cae02
SHA5127485c1e2149ed31b38639fd3bcedc80558a9cef73bdf852b4a4df41ec27c9eb2d183699b6d8051f688c3214e233d55024f7cfdc3819448ce38f1c5546a22e59c