Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26/03/2024, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
dfb4e28eaefda8e7dd87cda8bc66d12c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dfb4e28eaefda8e7dd87cda8bc66d12c.exe
Resource
win10v2004-20240226-en
General
-
Target
dfb4e28eaefda8e7dd87cda8bc66d12c.exe
-
Size
10.5MB
-
MD5
dfb4e28eaefda8e7dd87cda8bc66d12c
-
SHA1
01f793ffbddfedd0be3d9336431070985946aece
-
SHA256
447be4372af7afa914f4cbeacbeb1e0c5a2df26e1730598f44e4ad0609399cd7
-
SHA512
4996cc63e96be5ec785bb6df41c83898048005ceec75f701f439ebf82a744651575e86fd4c52c2c517c4c4c9e0c353eeaff0878a0db7ca4eae086444829e4454
-
SSDEEP
24576:uj8tdiKEvdYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYw:6Kg
Malware Config
Extracted
tofsee
43.231.4.6
lazystax.ru
Signatures
-
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3824 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lljiyuec\ImagePath = "C:\\Windows\\SysWOW64\\lljiyuec\\yvnearnl.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation dfb4e28eaefda8e7dd87cda8bc66d12c.exe -
Deletes itself 1 IoCs
pid Process 2500 svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 3192 yvnearnl.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3192 set thread context of 2500 3192 yvnearnl.exe 121 -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4420 sc.exe 4744 sc.exe 4356 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3052 5112 WerFault.exe 94 2156 3192 WerFault.exe 114 -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 5112 wrote to memory of 4416 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 102 PID 5112 wrote to memory of 4416 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 102 PID 5112 wrote to memory of 4416 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 102 PID 5112 wrote to memory of 4676 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 105 PID 5112 wrote to memory of 4676 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 105 PID 5112 wrote to memory of 4676 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 105 PID 5112 wrote to memory of 4420 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 107 PID 5112 wrote to memory of 4420 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 107 PID 5112 wrote to memory of 4420 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 107 PID 5112 wrote to memory of 4744 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 109 PID 5112 wrote to memory of 4744 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 109 PID 5112 wrote to memory of 4744 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 109 PID 5112 wrote to memory of 4356 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 111 PID 5112 wrote to memory of 4356 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 111 PID 5112 wrote to memory of 4356 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 111 PID 5112 wrote to memory of 3824 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 115 PID 5112 wrote to memory of 3824 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 115 PID 5112 wrote to memory of 3824 5112 dfb4e28eaefda8e7dd87cda8bc66d12c.exe 115 PID 3192 wrote to memory of 2500 3192 yvnearnl.exe 121 PID 3192 wrote to memory of 2500 3192 yvnearnl.exe 121 PID 3192 wrote to memory of 2500 3192 yvnearnl.exe 121 PID 3192 wrote to memory of 2500 3192 yvnearnl.exe 121 PID 3192 wrote to memory of 2500 3192 yvnearnl.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfb4e28eaefda8e7dd87cda8bc66d12c.exe"C:\Users\Admin\AppData\Local\Temp\dfb4e28eaefda8e7dd87cda8bc66d12c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lljiyuec\2⤵PID:4416
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yvnearnl.exe" C:\Windows\SysWOW64\lljiyuec\2⤵PID:4676
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create lljiyuec binPath= "C:\Windows\SysWOW64\lljiyuec\yvnearnl.exe /d\"C:\Users\Admin\AppData\Local\Temp\dfb4e28eaefda8e7dd87cda8bc66d12c.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:4420
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description lljiyuec "wifi internet conection"2⤵
- Launches sc.exe
PID:4744
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start lljiyuec2⤵
- Launches sc.exe
PID:4356
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:3824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5112 -s 13082⤵
- Program crash
PID:3052
-
-
C:\Windows\SysWOW64\lljiyuec\yvnearnl.exeC:\Windows\SysWOW64\lljiyuec\yvnearnl.exe /d"C:\Users\Admin\AppData\Local\Temp\dfb4e28eaefda8e7dd87cda8bc66d12c.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
PID:2500
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 5082⤵
- Program crash
PID:2156
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5112 -ip 51121⤵PID:3620
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3192 -ip 31921⤵PID:1568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3872 --field-trial-handle=2496,i,15897292497548307209,13920214570023230813,262144 --variations-seed-version /prefetch:81⤵PID:2600
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.6MB
MD5d2f577cd3b923131d7c4c47ceaa0dd20
SHA1d309fca7d9d5c140d3326dafe7da469e212ed794
SHA256cc516a83cbce9bc9ff809a3db887f9963b2c3355065b24c11904dd3970d5f426
SHA512a1996955a3046818817f341129d34116035082effe038c87aa8a4aeae24ccf433fd403ed3e250bfb88bab48e97e10c4b045ccc9a95bb928fb917487e9e05e1e2
-
Filesize
13.1MB
MD59af44930987c5c502268c2486891cfe2
SHA10500844cedb60b5c8478c79711743b9cf4f24fc4
SHA256fa8a43df56a294f54d98065c5369fe35f1da18334c05bd53d9363fe5a9420f7f
SHA51250e65c0842e0694f3ddc47caa3912d91d7493610ea119ede88b2aa763e8098b0e4779e6e77ccfa7dc538a50fa0e3fcfad189addf1a139c242d0a4a6c6906ad01