Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7 -
submitted
09/10/2020, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
osno-crypted.bin.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
osno-crypted.bin.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
osno-crypted.bin.exe
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1684 Osno Decryptor.exe -
Loads dropped DLL 6 IoCs
pid Process 1588 MSBuild.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1668 set thread context of 1588 1668 osno-crypted.bin.exe 28 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\program files\7-zip\lang\sv.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\alphabet.xml MSBuild.exe File opened for modification \??\c:\program files\7-zip\readme.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\slate\preview.gif MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\jre\lib\images\cursors\win32_movedrop32x32.gif MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\outlook.en-us\outlookmui.xml MSBuild.exe File opened for modification \??\c:\program files\dvd maker\shared\dvdstyles\stacking\1047x576black.png MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\javap.exe MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\jre\bin\rmid.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\axis\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\dvd maker\shared\dvdstyles\16to9squareframe_buttongraphic.png MSBuild.exe File opened for modification \??\c:\program files\7-zip\7zg.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\office.en-us\officemui.xml MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\jre\welcome.html MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\pixel\thmbnail.png MSBuild.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\oldage\1047x576black.png MSBuild.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\vignette\1047x576black.png MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\pt.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml MSBuild.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\web\webbase.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\blueprnt\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\javah.exe MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\jmc.exe MSBuild.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\ea.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\fltldr.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\infopath.en-us\infopathmui.xml MSBuild.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\access.en-us\accessmui.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\boldstri\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\watermar\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\onenote.en-us\setup.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\smart tag\lists\1033\time.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\canyon\thmbnail.png MSBuild.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\performance\720x480blacksquare.png MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\hu.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\grphflt\ms.png MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\office32.en-us\setup.xml MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\schemagen.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\proplus\proplusww.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\cascade\preview.gif MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\jre\bin\unpack200.exe MSBuild.exe File created \??\c:\program files\common files\microsoft shared\msinfo\msinfo32.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\liclua.exe MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\jar.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\proof.fr\proof.xml MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\th.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\smart tag\smarttaginstall.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\arctic\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\papyrus\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\fur.txt MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\io.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\sumipntg\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\layers\preview.gif MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\klist.exe MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\include\win32\jni_md.h MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\capsules\preview.gif MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\idlj.exe MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\is.txt MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\ast.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\dw\dwtrig20.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\powerpoint.en-us\setup.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\en-us\boxed-correct.avi MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\include\win32\bridge\accessbridgepackages.h MSBuild.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 852 1684 WerFault.exe 38 -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 784 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1588 MSBuild.exe 1588 MSBuild.exe 1588 MSBuild.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 784 tasklist.exe Token: SeDebugPrivilege 1588 MSBuild.exe Token: SeDebugPrivilege 852 WerFault.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe 28 PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe 28 PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe 28 PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe 28 PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe 28 PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe 28 PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe 28 PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe 28 PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe 28 PID 1588 wrote to memory of 1228 1588 MSBuild.exe 29 PID 1588 wrote to memory of 1228 1588 MSBuild.exe 29 PID 1588 wrote to memory of 1228 1588 MSBuild.exe 29 PID 1588 wrote to memory of 1228 1588 MSBuild.exe 29 PID 1228 wrote to memory of 1020 1228 cmd.exe 31 PID 1228 wrote to memory of 1020 1228 cmd.exe 31 PID 1228 wrote to memory of 1020 1228 cmd.exe 31 PID 1228 wrote to memory of 1020 1228 cmd.exe 31 PID 1228 wrote to memory of 240 1228 cmd.exe 32 PID 1228 wrote to memory of 240 1228 cmd.exe 32 PID 1228 wrote to memory of 240 1228 cmd.exe 32 PID 1228 wrote to memory of 240 1228 cmd.exe 32 PID 1228 wrote to memory of 1472 1228 cmd.exe 33 PID 1228 wrote to memory of 1472 1228 cmd.exe 33 PID 1228 wrote to memory of 1472 1228 cmd.exe 33 PID 1228 wrote to memory of 1472 1228 cmd.exe 33 PID 1588 wrote to memory of 748 1588 MSBuild.exe 34 PID 1588 wrote to memory of 748 1588 MSBuild.exe 34 PID 1588 wrote to memory of 748 1588 MSBuild.exe 34 PID 1588 wrote to memory of 748 1588 MSBuild.exe 34 PID 748 wrote to memory of 784 748 cmd.exe 37 PID 748 wrote to memory of 784 748 cmd.exe 37 PID 748 wrote to memory of 784 748 cmd.exe 37 PID 748 wrote to memory of 784 748 cmd.exe 37 PID 1588 wrote to memory of 1684 1588 MSBuild.exe 38 PID 1588 wrote to memory of 1684 1588 MSBuild.exe 38 PID 1588 wrote to memory of 1684 1588 MSBuild.exe 38 PID 1588 wrote to memory of 1684 1588 MSBuild.exe 38 PID 1684 wrote to memory of 852 1684 Osno Decryptor.exe 40 PID 1684 wrote to memory of 852 1684 Osno Decryptor.exe 40 PID 1684 wrote to memory of 852 1684 Osno Decryptor.exe 40 PID 1684 wrote to memory of 852 1684 Osno Decryptor.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\osno-crypted.bin.exe"C:\Users\Admin\AppData\Local\Temp\osno-crypted.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\chcp.comchcp 650014⤵PID:1020
-
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵PID:240
-
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵PID:1472
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C tasklist /FO TABLE > "C:\Users\Admin\AppData\Local\Temp\3873d8888a3836bc92341667cb978e5e\9965f44e6f4047c4479d448e0c207069\processes.txt"3⤵
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\tasklist.exetasklist /FO TABLE4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:784
-
-
-
C:\Users\Admin\Desktop\Osno Decryptor.exe"C:\Users\Admin\Desktop\Osno Decryptor.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 6564⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
-