Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 13:33
Static task
static1
Behavioral task
behavioral1
Sample
7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe
Resource
win10v2004-20240412-en
General
-
Target
7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe
-
Size
229KB
-
MD5
ddb3205a92ff18ae17b3f9f93c7b197c
-
SHA1
b77c666a2d7b1f63ba08316f9a221be6ac1f786a
-
SHA256
7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8
-
SHA512
db659ead4fd2ed186f221adf5bb9ab5b686253454eeb307ba247a99d8026c009d72ed11473d4622146c7b6cf59f445ad3b020ac3394d3f61af5bfd385b43c334
-
SSDEEP
3072:lnUQviqZALXadUs0vEJimn1K29YbqYZgpLneYDR89fJ5j3UxS6MeILYS:lnUzPjflapLnsdT3U2eILY
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\SysWOW64\dbemfjpx = "0" svchost.exe -
Creates new service(s) 1 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2532 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\dbemfjpx\ImagePath = "C:\\Windows\\SysWOW64\\dbemfjpx\\wzsddmnn.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 108 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
wzsddmnn.exepid process 2624 wzsddmnn.exe -
Drops file in System32 directory 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe File created C:\Windows\SysWOW64\config\systemprofile:.repos svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wzsddmnn.exedescription pid process target process PID 2624 set thread context of 108 2624 wzsddmnn.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 2568 sc.exe 2820 sc.exe 2700 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Control Panel\Buses svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = 74ab243d3d7d0d0324edb47d450dd49d084297dce82e72baa49c23fdb47f431d55ac1b9381cd945d24edb47d470dd49d024195daf71261adc06d04fda6e22673bbc9154961cda5681cda854e7439e6af644490bdb57c25ee965f04cff0bb54758df21d5904e0a56813d48c48763fe7a564419bdce0286682cd0934c9c4e4241ddc95400a37fda66413edc70f3252a0f40948f490b57923eb915e0dcff5bc54718bce15515bb9fd3041ed85487c3ae5ae5419c68884a934d3a45784649a8d541de4ac743d04bafb2f4fb2c70f320dd49d642df4bd847b108dd42834fdc48d57d1f6ae743d04cca26f0adc864f6a3ceca94a18ccbd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743d04cd725c24ed svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Buses\Config0 = ac7e243d3e7d0d0324edb47d450dd49d134286d6db3e66aba46d34fdc48d541dd2a9244d41cd945d24ee786f470dd49d651bc693b57f26f3955500d3f1b5541de4ad743d04cd945d24edb47d440dd49d642df4bd844d14dda46d34fdc48d541de4ad743d04cd945d24edb47d440dd49d64cbf5bd847dbf8da42f84649a8d541de4ac743d04a1fb3e4581d71b230d258a645d06aa84006dcbc2ee34fdc48d541de4ae743d04abf83c439eeb083469d4ad644f9bcfea1270bcd00834ccf1b5632cd79d400f36cdfd3924dc854c773fe6ad5619c2bdec244bb4c06d19ccf1ba6d25d19f460e3ccdf8324589d10f1b64b09d502d9dcd847b22e5945e00c9fdb8546e96db2b496da0f15d12df834b7d3be4aa5d2d98d2e72c7882d0045998c4bc6125d39c470d30fea05dc0cdba7d14bd4dc3642df4bd864d14dded2906caf5b8652cd19d410504cd945d8ca36e3d400dd49d642df4bd874d14dd9633e15c svchost.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exewzsddmnn.exedescription pid process target process PID 2144 wrote to memory of 1972 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe cmd.exe PID 2144 wrote to memory of 1972 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe cmd.exe PID 2144 wrote to memory of 1972 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe cmd.exe PID 2144 wrote to memory of 1972 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe cmd.exe PID 2144 wrote to memory of 2556 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe cmd.exe PID 2144 wrote to memory of 2556 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe cmd.exe PID 2144 wrote to memory of 2556 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe cmd.exe PID 2144 wrote to memory of 2556 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe cmd.exe PID 2144 wrote to memory of 2568 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2568 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2568 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2568 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2820 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2820 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2820 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2820 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2700 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2700 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2700 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2144 wrote to memory of 2700 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe sc.exe PID 2624 wrote to memory of 108 2624 wzsddmnn.exe svchost.exe PID 2624 wrote to memory of 108 2624 wzsddmnn.exe svchost.exe PID 2624 wrote to memory of 108 2624 wzsddmnn.exe svchost.exe PID 2624 wrote to memory of 108 2624 wzsddmnn.exe svchost.exe PID 2624 wrote to memory of 108 2624 wzsddmnn.exe svchost.exe PID 2624 wrote to memory of 108 2624 wzsddmnn.exe svchost.exe PID 2144 wrote to memory of 2532 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe netsh.exe PID 2144 wrote to memory of 2532 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe netsh.exe PID 2144 wrote to memory of 2532 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe netsh.exe PID 2144 wrote to memory of 2532 2144 7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe"C:\Users\Admin\AppData\Local\Temp\7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dbemfjpx\2⤵PID:1972
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wzsddmnn.exe" C:\Windows\SysWOW64\dbemfjpx\2⤵PID:2556
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create dbemfjpx binPath= "C:\Windows\SysWOW64\dbemfjpx\wzsddmnn.exe /d\"C:\Users\Admin\AppData\Local\Temp\7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
PID:2568 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description dbemfjpx "wifi internet conection"2⤵
- Launches sc.exe
PID:2820 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start dbemfjpx2⤵
- Launches sc.exe
PID:2700 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
PID:2532
-
C:\Windows\SysWOW64\dbemfjpx\wzsddmnn.exeC:\Windows\SysWOW64\dbemfjpx\wzsddmnn.exe /d"C:\Users\Admin\AppData\Local\Temp\7c44a7de2a7c4175c761e08a2de5d2acd42ad3195d7686e5b8d507f99c30adc8.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Windows security bypass
- Sets service image path in registry
- Deletes itself
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:108
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\wzsddmnn.exeFilesize
14.2MB
MD51feec5554a305aee4ee207da3c8f9826
SHA10778b561c9972e088e92e2cab140130f2a4a00a2
SHA256fe70bb300d78913869d6a14c103b75f109a5490e7d27326c9cc39c1136942a16
SHA512b1970aa7514aaa5bae2d90d135d0ec30563ac86c250ee7e73f0b7bb28b3529c28ce49fe4d8919c521fa71bd02817c966060e60ffec245e632429cd5accd4f9df
-
memory/108-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/108-14-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/108-11-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/108-23-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/108-21-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/108-20-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/108-18-0x00000000000D0000-0x00000000000E5000-memory.dmpFilesize
84KB
-
memory/2144-19-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2144-2-0x0000000000220000-0x0000000000233000-memory.dmpFilesize
76KB
-
memory/2144-3-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2144-1-0x00000000005F0000-0x00000000006F0000-memory.dmpFilesize
1024KB
-
memory/2624-9-0x00000000002E0000-0x00000000002F3000-memory.dmpFilesize
76KB
-
memory/2624-8-0x0000000000610000-0x0000000000710000-memory.dmpFilesize
1024KB
-
memory/2624-10-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/2624-16-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB