Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
31-08-2024 15:14
Static task
static1
Behavioral task
behavioral1
Sample
79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe
Resource
win10v2004-20240802-en
General
-
Target
79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe
-
Size
12.5MB
-
MD5
aee483bf0ab0bbba03e7add1c7b24d70
-
SHA1
15ef01d3f681c7ec8cfb1e55a318723f4f4406f7
-
SHA256
79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f
-
SHA512
4dfe9bb49aec68b29055ab74aaac4efd83e96051072aa9f15bd2a8530376ba58f1b3d7741229a5fd96f81cd92ead9481918b4fe580bcc4baae158269d985d80e
-
SSDEEP
6144:0ngjLKfnGE+Nj43Gd/50NS0UG4th+d49EOVVVVVVVVVVVVVVVVVVVVVVVVVVVVV7:fiOE+Nj4Q50k0UGIh+dJ
Malware Config
Extracted
tofsee
defeatwax.ru
refabyd.info
Signatures
-
Creates new service(s) 2 TTPs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3392 netsh.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aafmxldy\ImagePath = "C:\\Windows\\SysWOW64\\aafmxldy\\psltrtbl.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 4072 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
psltrtbl.exepid process 2520 psltrtbl.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
psltrtbl.exedescription pid process target process PID 2520 set thread context of 4072 2520 psltrtbl.exe svchost.exe -
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 3816 sc.exe 1216 sc.exe 2948 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3136 3364 WerFault.exe 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe 4432 2520 WerFault.exe psltrtbl.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
sc.exesc.exesc.exenetsh.exe79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.execmd.exepsltrtbl.exesvchost.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language psltrtbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exepsltrtbl.exedescription pid process target process PID 3364 wrote to memory of 3488 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe cmd.exe PID 3364 wrote to memory of 3488 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe cmd.exe PID 3364 wrote to memory of 3488 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe cmd.exe PID 3364 wrote to memory of 368 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe cmd.exe PID 3364 wrote to memory of 368 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe cmd.exe PID 3364 wrote to memory of 368 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe cmd.exe PID 3364 wrote to memory of 3816 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe sc.exe PID 3364 wrote to memory of 3816 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe sc.exe PID 3364 wrote to memory of 3816 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe sc.exe PID 3364 wrote to memory of 1216 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe sc.exe PID 3364 wrote to memory of 1216 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe sc.exe PID 3364 wrote to memory of 1216 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe sc.exe PID 3364 wrote to memory of 2948 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe sc.exe PID 3364 wrote to memory of 2948 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe sc.exe PID 3364 wrote to memory of 2948 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe sc.exe PID 3364 wrote to memory of 3392 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe netsh.exe PID 3364 wrote to memory of 3392 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe netsh.exe PID 3364 wrote to memory of 3392 3364 79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe netsh.exe PID 2520 wrote to memory of 4072 2520 psltrtbl.exe svchost.exe PID 2520 wrote to memory of 4072 2520 psltrtbl.exe svchost.exe PID 2520 wrote to memory of 4072 2520 psltrtbl.exe svchost.exe PID 2520 wrote to memory of 4072 2520 psltrtbl.exe svchost.exe PID 2520 wrote to memory of 4072 2520 psltrtbl.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe"C:\Users\Admin\AppData\Local\Temp\79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\aafmxldy\2⤵
- System Location Discovery: System Language Discovery
PID:3488 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\psltrtbl.exe" C:\Windows\SysWOW64\aafmxldy\2⤵
- System Location Discovery: System Language Discovery
PID:368 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create aafmxldy binPath= "C:\Windows\SysWOW64\aafmxldy\psltrtbl.exe /d\"C:\Users\Admin\AppData\Local\Temp\79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3816 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description aafmxldy "wifi internet conection"2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1216 -
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start aafmxldy2⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:3392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 7842⤵
- Program crash
PID:3136
-
C:\Windows\SysWOW64\aafmxldy\psltrtbl.exeC:\Windows\SysWOW64\aafmxldy\psltrtbl.exe /d"C:\Users\Admin\AppData\Local\Temp\79231c2cacbfc0da610bb317d280a96d0d10e63a5824d5d052e41e57fb85bd6f.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Sets service image path in registry
- Deletes itself
- System Location Discovery: System Language Discovery
PID:4072 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2520 -s 5162⤵
- Program crash
PID:4432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3364 -ip 33641⤵PID:4048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2520 -ip 25201⤵PID:3712
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.3MB
MD5a75cef01afaa76ad3a3525116d64d5bd
SHA107e952f4600aefb9833ce28192f01ccdd84f5ee0
SHA2564fe5f48b274884668339e60158e77dcb87411685aa3ebef7ae78925d6af97b75
SHA5123c541edd78dba8dd09e1e592e854d0e2663fb8cadc24fc241d4fff25262d659d87a694e7e96bd5ce87ca0cb65002a6e95846f23899a636480389ac9c8ef36571