Analysis
-
max time kernel
144s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/03/2024, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
dfb4e28eaefda8e7dd87cda8bc66d12c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dfb4e28eaefda8e7dd87cda8bc66d12c.exe
Resource
win10v2004-20240226-en
General
-
Target
dfb4e28eaefda8e7dd87cda8bc66d12c.exe
-
Size
10.5MB
-
MD5
dfb4e28eaefda8e7dd87cda8bc66d12c
-
SHA1
01f793ffbddfedd0be3d9336431070985946aece
-
SHA256
447be4372af7afa914f4cbeacbeb1e0c5a2df26e1730598f44e4ad0609399cd7
-
SHA512
4996cc63e96be5ec785bb6df41c83898048005ceec75f701f439ebf82a744651575e86fd4c52c2c517c4c4c9e0c353eeaff0878a0db7ca4eae086444829e4454
-
SSDEEP
24576:uj8tdiKEvdYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYw:6Kg
Malware Config
Extracted
tofsee
43.231.4.6
lazystax.ru
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\sqjtlinn = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2056 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\sqjtlinn\ImagePath = "C:\\Windows\\SysWOW64\\sqjtlinn\\hwaeuhyy.exe" svchost.exe -
Deletes itself 1 IoCs
pid Process 2940 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 2524 hwaeuhyy.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2524 set thread context of 2940 2524 hwaeuhyy.exe 41 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2540 sc.exe 2660 sc.exe 2796 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2020 wrote to memory of 1152 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 28 PID 2020 wrote to memory of 1152 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 28 PID 2020 wrote to memory of 1152 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 28 PID 2020 wrote to memory of 1152 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 28 PID 2020 wrote to memory of 2268 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 30 PID 2020 wrote to memory of 2268 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 30 PID 2020 wrote to memory of 2268 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 30 PID 2020 wrote to memory of 2268 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 30 PID 2020 wrote to memory of 2660 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 32 PID 2020 wrote to memory of 2660 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 32 PID 2020 wrote to memory of 2660 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 32 PID 2020 wrote to memory of 2660 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 32 PID 2020 wrote to memory of 2796 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 34 PID 2020 wrote to memory of 2796 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 34 PID 2020 wrote to memory of 2796 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 34 PID 2020 wrote to memory of 2796 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 34 PID 2020 wrote to memory of 2540 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 36 PID 2020 wrote to memory of 2540 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 36 PID 2020 wrote to memory of 2540 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 36 PID 2020 wrote to memory of 2540 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 36 PID 2020 wrote to memory of 2056 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 39 PID 2020 wrote to memory of 2056 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 39 PID 2020 wrote to memory of 2056 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 39 PID 2020 wrote to memory of 2056 2020 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 39 PID 2524 wrote to memory of 2940 2524 hwaeuhyy.exe 41 PID 2524 wrote to memory of 2940 2524 hwaeuhyy.exe 41 PID 2524 wrote to memory of 2940 2524 hwaeuhyy.exe 41 PID 2524 wrote to memory of 2940 2524 hwaeuhyy.exe 41 PID 2524 wrote to memory of 2940 2524 hwaeuhyy.exe 41 PID 2524 wrote to memory of 2940 2524 hwaeuhyy.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfb4e28eaefda8e7dd87cda8bc66d12c.exe"C:\Users\Admin\AppData\Local\Temp\dfb4e28eaefda8e7dd87cda8bc66d12c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\sqjtlinn\2⤵PID:1152
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\hwaeuhyy.exe" C:\Windows\SysWOW64\sqjtlinn\2⤵PID:2268
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create sqjtlinn binPath= "C:\Windows\SysWOW64\sqjtlinn\hwaeuhyy.exe /d\"C:\Users\Admin\AppData\Local\Temp\dfb4e28eaefda8e7dd87cda8bc66d12c.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2660
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description sqjtlinn "wifi internet conection"2⤵
- Launches sc.exe
PID:2796
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start sqjtlinn2⤵
- Launches sc.exe
PID:2540
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2056
-
-
C:\Windows\SysWOW64\sqjtlinn\hwaeuhyy.exeC:\Windows\SysWOW64\sqjtlinn\hwaeuhyy.exe /d"C:\Users\Admin\AppData\Local\Temp\dfb4e28eaefda8e7dd87cda8bc66d12c.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
PID:2940
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.0MB
MD51dd0c78adbced433738d8f3092258da9
SHA1f44d6ea34d86885ad791bd19dd05413582cd5cae
SHA256b9ad79c65c50f6bdedbb0360de9b11b788692a3ff22df251d3a7a93e64cf49d8
SHA512f7c8192b0bf84a8ecf1c20ba247ec67f31cc65c7330c80e6f4b230dd92648de5b8a4368f89d02eb8cbea58d9fcddc962664d3f8d53069700b8b61e0d997bae70
-
Filesize
5.9MB
MD52c4621426e0c64a8e0a66e3827037fd4
SHA198e9070a380abdeaaa649af2073aba248b82528b
SHA2567201007943f6b82b561ac8c91dbb7d8a81573d3015d4ca492e14cb78a720b084
SHA512449ffea02908ad50378b9227fa5aa448d0e8af46a1e1da3cc362230a29bf242d585cf1fc3364f64527f3f63ff21919c57f9bd6e92b358900057b2dfa00fe424b