Analysis

  • max time kernel
    28s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-05-2024 05:54

General

  • Target

    b7ab94357342f73380569c9b23bc81741e1784b8a7cfdfe8df680000a1f3da1f.exe

  • Size

    178KB

  • MD5

    a6c7dd82eace106350d20d93956360e6

  • SHA1

    19c5ea0607b527e4c2b08a39583db38f503933e0

  • SHA256

    b7ab94357342f73380569c9b23bc81741e1784b8a7cfdfe8df680000a1f3da1f

  • SHA512

    6e3d950e1a16103710985e9e0993f26ece5f7d67eadbd711941e826117d0d884624ddf166d3a70e25453518bb2f7d9a9c2dede25f6785dcb24d6031ba29c419e

  • SSDEEP

    1536:DAc76NGJEzLoCPMkXzxIGzA9aRmNjo/Phcnr6xMtxUtoIlESP5tA9bDQqpN+X:D7kXzxIGzA9aUo/PhcnVHUtoe5K9

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Signatures

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Creates new service(s) 2 TTPs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7ab94357342f73380569c9b23bc81741e1784b8a7cfdfe8df680000a1f3da1f.exe
    "C:\Users\Admin\AppData\Local\Temp\b7ab94357342f73380569c9b23bc81741e1784b8a7cfdfe8df680000a1f3da1f.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\gezbwezt\
      2⤵
        PID:348
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\pyepncu.exe" C:\Windows\SysWOW64\gezbwezt\
        2⤵
          PID:3020
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create gezbwezt binPath= "C:\Windows\SysWOW64\gezbwezt\pyepncu.exe /d\"C:\Users\Admin\AppData\Local\Temp\b7ab94357342f73380569c9b23bc81741e1784b8a7cfdfe8df680000a1f3da1f.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:1276
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description gezbwezt "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:2644
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start gezbwezt
          2⤵
          • Launches sc.exe
          PID:2880
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:2768
      • C:\Windows\SysWOW64\gezbwezt\pyepncu.exe
        C:\Windows\SysWOW64\gezbwezt\pyepncu.exe /d"C:\Users\Admin\AppData\Local\Temp\b7ab94357342f73380569c9b23bc81741e1784b8a7cfdfe8df680000a1f3da1f.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Deletes itself
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:2240
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        1⤵
          PID:1948
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          1⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:1912
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5b29758,0x7fef5b29768,0x7fef5b29778
            2⤵
              PID:2336
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1116 --field-trial-handle=1408,i,4107929733259891060,6723012008410717658,131072 /prefetch:2
              2⤵
                PID:1084
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1408,i,4107929733259891060,6723012008410717658,131072 /prefetch:8
                2⤵
                  PID:2256
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1408,i,4107929733259891060,6723012008410717658,131072 /prefetch:8
                  2⤵
                    PID:2084
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2336 --field-trial-handle=1408,i,4107929733259891060,6723012008410717658,131072 /prefetch:1
                    2⤵
                      PID:2748
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2352 --field-trial-handle=1408,i,4107929733259891060,6723012008410717658,131072 /prefetch:1
                      2⤵
                        PID:320
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1392 --field-trial-handle=1408,i,4107929733259891060,6723012008410717658,131072 /prefetch:2
                        2⤵
                          PID:2668
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1336 --field-trial-handle=1408,i,4107929733259891060,6723012008410717658,131072 /prefetch:1
                          2⤵
                            PID:1584
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1344 --field-trial-handle=1408,i,4107929733259891060,6723012008410717658,131072 /prefetch:8
                            2⤵
                              PID:2516
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3044 --field-trial-handle=1408,i,4107929733259891060,6723012008410717658,131072 /prefetch:8
                              2⤵
                                PID:2952
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3568 --field-trial-handle=1408,i,4107929733259891060,6723012008410717658,131072 /prefetch:8
                                2⤵
                                  PID:1444
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:672

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                  Filesize

                                  16B

                                  MD5

                                  aefd77f47fb84fae5ea194496b44c67a

                                  SHA1

                                  dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                  SHA256

                                  4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                  SHA512

                                  b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                  Filesize

                                  264KB

                                  MD5

                                  f50f89a0a91564d0b8a211f8921aa7de

                                  SHA1

                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                  SHA256

                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                  SHA512

                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                  Filesize

                                  16B

                                  MD5

                                  18e723571b00fb1694a3bad6c78e4054

                                  SHA1

                                  afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                  SHA256

                                  8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                  SHA512

                                  43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                • C:\Users\Admin\AppData\Local\Temp\pyepncu.exe

                                  Filesize

                                  14.8MB

                                  MD5

                                  8cc69514b30b70b574d86e533de31cc8

                                  SHA1

                                  deb644326a12fb28e3d71d7ead0dda0d6d817665

                                  SHA256

                                  4421d5a46e297d3bd27aa6fb1866464275124f2a1fd3f8a16410f78091dc6189

                                  SHA512

                                  d0f31a644430b893c4276c8c66b649b77e3789b6495fda6a3660ff033c0bfdfe075659baba86c851a60eacbfd1bb5c21c5099aa0069af2b8d508d29015681af1

                                • \??\pipe\crashpad_1912_QJHBAEYTEIPZDCVG

                                  MD5

                                  d41d8cd98f00b204e9800998ecf8427e

                                  SHA1

                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                  SHA256

                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                  SHA512

                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                • memory/1944-1-0x00000000023E0000-0x00000000024E0000-memory.dmp

                                  Filesize

                                  1024KB

                                • memory/1944-3-0x0000000000400000-0x0000000000415000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/1944-2-0x0000000000220000-0x0000000000233000-memory.dmp

                                  Filesize

                                  76KB

                                • memory/1944-15-0x0000000000400000-0x0000000000415000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/1944-14-0x0000000000400000-0x0000000002349000-memory.dmp

                                  Filesize

                                  31.3MB

                                • memory/2240-44-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-39-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-19-0x0000000001990000-0x0000000001B9F000-memory.dmp

                                  Filesize

                                  2.1MB

                                • memory/2240-23-0x0000000000210000-0x0000000000216000-memory.dmp

                                  Filesize

                                  24KB

                                • memory/2240-54-0x0000000000280000-0x0000000000287000-memory.dmp

                                  Filesize

                                  28KB

                                • memory/2240-53-0x00000000055F0000-0x00000000059FB000-memory.dmp

                                  Filesize

                                  4.0MB

                                • memory/2240-50-0x00000000055F0000-0x00000000059FB000-memory.dmp

                                  Filesize

                                  4.0MB

                                • memory/2240-49-0x0000000000270000-0x0000000000275000-memory.dmp

                                  Filesize

                                  20KB

                                • memory/2240-46-0x0000000000270000-0x0000000000275000-memory.dmp

                                  Filesize

                                  20KB

                                • memory/2240-45-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-16-0x0000000000080000-0x0000000000095000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/2240-43-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-42-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-41-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-40-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-17-0x0000000000080000-0x0000000000095000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/2240-38-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-37-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-36-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-35-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-34-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-33-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-32-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-31-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-30-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-29-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-26-0x0000000000260000-0x0000000000270000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/2240-22-0x0000000001990000-0x0000000001B9F000-memory.dmp

                                  Filesize

                                  2.1MB

                                • memory/2240-11-0x0000000000080000-0x0000000000095000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/2240-8-0x0000000000080000-0x0000000000095000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/2240-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2564-12-0x0000000000400000-0x0000000002349000-memory.dmp

                                  Filesize

                                  31.3MB