Analysis
-
max time kernel
148s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
df9b061b8b91e89659ad8592ce4ea7ad.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
df9b061b8b91e89659ad8592ce4ea7ad.exe
Resource
win10v2004-20240226-en
General
-
Target
df9b061b8b91e89659ad8592ce4ea7ad.exe
-
Size
10.6MB
-
MD5
df9b061b8b91e89659ad8592ce4ea7ad
-
SHA1
182c7d734f20a4145fff57048f1b0b443d02d5bc
-
SHA256
be0186fe58064c8c88db16927a48a857699ba9ea162d49192dc2b152637d8aa4
-
SHA512
7152b581cb9bdaf6af797d27f4e8a23a7403e77bd4aced1a98424d9f9a585ad7d615ed44285b2085e75255c5c7aa288c931564f5442145fd695b7787e9674a51
-
SSDEEP
49152:URBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB5:
Malware Config
Extracted
tofsee
43.231.4.6
lazystax.ru
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\kcjczhaa = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2712 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\kcjczhaa\ImagePath = "C:\\Windows\\SysWOW64\\kcjczhaa\\gmxiapjv.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2368 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2444 gmxiapjv.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2444 set thread context of 2368 2444 gmxiapjv.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2624 sc.exe 2588 sc.exe 2692 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2068 wrote to memory of 2844 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 28 PID 2068 wrote to memory of 2844 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 28 PID 2068 wrote to memory of 2844 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 28 PID 2068 wrote to memory of 2844 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 28 PID 2068 wrote to memory of 2908 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 30 PID 2068 wrote to memory of 2908 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 30 PID 2068 wrote to memory of 2908 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 30 PID 2068 wrote to memory of 2908 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 30 PID 2068 wrote to memory of 2624 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 32 PID 2068 wrote to memory of 2624 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 32 PID 2068 wrote to memory of 2624 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 32 PID 2068 wrote to memory of 2624 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 32 PID 2068 wrote to memory of 2588 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 34 PID 2068 wrote to memory of 2588 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 34 PID 2068 wrote to memory of 2588 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 34 PID 2068 wrote to memory of 2588 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 34 PID 2068 wrote to memory of 2692 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 36 PID 2068 wrote to memory of 2692 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 36 PID 2068 wrote to memory of 2692 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 36 PID 2068 wrote to memory of 2692 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 36 PID 2068 wrote to memory of 2712 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 39 PID 2068 wrote to memory of 2712 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 39 PID 2068 wrote to memory of 2712 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 39 PID 2068 wrote to memory of 2712 2068 df9b061b8b91e89659ad8592ce4ea7ad.exe 39 PID 2444 wrote to memory of 2368 2444 gmxiapjv.exe 41 PID 2444 wrote to memory of 2368 2444 gmxiapjv.exe 41 PID 2444 wrote to memory of 2368 2444 gmxiapjv.exe 41 PID 2444 wrote to memory of 2368 2444 gmxiapjv.exe 41 PID 2444 wrote to memory of 2368 2444 gmxiapjv.exe 41 PID 2444 wrote to memory of 2368 2444 gmxiapjv.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\df9b061b8b91e89659ad8592ce4ea7ad.exe"C:\Users\Admin\AppData\Local\Temp\df9b061b8b91e89659ad8592ce4ea7ad.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kcjczhaa\2⤵PID:2844
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\gmxiapjv.exe" C:\Windows\SysWOW64\kcjczhaa\2⤵PID:2908
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create kcjczhaa binPath= "C:\Windows\SysWOW64\kcjczhaa\gmxiapjv.exe /d\"C:\Users\Admin\AppData\Local\Temp\df9b061b8b91e89659ad8592ce4ea7ad.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2624
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description kcjczhaa "wifi internet conection"2⤵
- Launches sc.exe
PID:2588
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start kcjczhaa2⤵
- Launches sc.exe
PID:2692
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2712
-
-
C:\Windows\SysWOW64\kcjczhaa\gmxiapjv.exeC:\Windows\SysWOW64\kcjczhaa\gmxiapjv.exe /d"C:\Users\Admin\AppData\Local\Temp\df9b061b8b91e89659ad8592ce4ea7ad.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
MD51b290650d808b4c3dcc7465229bda8de
SHA1f48018f8489d8f130cb8144af74d13a86c5479ff
SHA256a89522a6e3729073b517218217002bd2b8d3041ae0a7291d9ccc3bc01fab36f7
SHA51208e204361d396ccf3b1dd7e2960439525371a6e33aea630d390873109ae9636e67f9245498f1c2e425de93745801b13d682b2e1e256aa3d5821ca8a3970ab2fa
-
Filesize
3.1MB
MD5c4c08b35b5a92121ddfb34bdfd0b54a2
SHA1ffb4bc63d13fba3f05f2616107888cc600dc96db
SHA256523fa42140ca9fd830ba5097a8a09d6f90ae58b6e675104e0d275e9bde42e672
SHA51237ab7c198e2d57df9b9be01e328502c11bffede4e68d63828464b77868762c1fb931b1d55b678a59b6e1d96b9dc5373218c4294c58a5172aacabf4a150a66d73