Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7 -
submitted
09-10-2020 11:15
Static task
static1
Behavioral task
behavioral1
Sample
osno-crypted.bin.exe
Resource
win7
Behavioral task
behavioral2
Sample
osno-crypted.bin.exe
Resource
win10v200722
General
-
Target
osno-crypted.bin.exe
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Osno Decryptor.exepid process 1684 Osno Decryptor.exe -
Loads dropped DLL 6 IoCs
Processes:
MSBuild.exeWerFault.exepid process 1588 MSBuild.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
osno-crypted.bin.exedescription pid process target process PID 1668 set thread context of 1588 1668 osno-crypted.bin.exe MSBuild.exe -
Drops file in Program Files directory 64 IoCs
Processes:
MSBuild.exedescription ioc process File opened for modification \??\c:\program files\7-zip\lang\sv.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\alphabet.xml MSBuild.exe File opened for modification \??\c:\program files\7-zip\readme.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\slate\preview.gif MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\jre\lib\images\cursors\win32_movedrop32x32.gif MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\outlook.en-us\outlookmui.xml MSBuild.exe File opened for modification \??\c:\program files\dvd maker\shared\dvdstyles\stacking\1047x576black.png MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\javap.exe MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\jre\bin\rmid.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\axis\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\dvd maker\shared\dvdstyles\16to9squareframe_buttongraphic.png MSBuild.exe File opened for modification \??\c:\program files\7-zip\7zg.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\office.en-us\officemui.xml MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\jre\welcome.html MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\pixel\thmbnail.png MSBuild.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\oldage\1047x576black.png MSBuild.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\vignette\1047x576black.png MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\pt.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml MSBuild.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\web\webbase.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\blueprnt\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\javah.exe MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\jmc.exe MSBuild.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\ea.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\fltldr.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\infopath.en-us\infopathmui.xml MSBuild.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\access.en-us\accessmui.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\boldstri\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\watermar\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\onenote.en-us\setup.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\smart tag\lists\1033\time.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\canyon\thmbnail.png MSBuild.exe File created \??\c:\program files\dvd maker\shared\dvdstyles\performance\720x480blacksquare.png MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\hu.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\grphflt\ms.png MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\office32.en-us\setup.xml MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\schemagen.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\proplus\proplusww.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\cascade\preview.gif MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\jre\bin\unpack200.exe MSBuild.exe File created \??\c:\program files\common files\microsoft shared\msinfo\msinfo32.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\liclua.exe MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\jar.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\proof.fr\proof.xml MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\th.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\smart tag\smarttaginstall.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\arctic\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\papyrus\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\fur.txt MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\io.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\sumipntg\thmbnail.png MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\layers\preview.gif MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\klist.exe MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\include\win32\jni_md.h MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\themes14\capsules\preview.gif MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\bin\idlj.exe MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\is.txt MSBuild.exe File opened for modification \??\c:\program files\7-zip\lang\ast.txt MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\dw\dwtrig20.exe MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\office14\office setup controller\powerpoint.en-us\setup.xml MSBuild.exe File opened for modification \??\c:\program files\common files\microsoft shared\ink\en-us\boxed-correct.avi MSBuild.exe File opened for modification \??\c:\program files\java\jdk1.7.0_80\include\win32\bridge\accessbridgepackages.h MSBuild.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 852 1684 WerFault.exe Osno Decryptor.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
MSBuild.exeWerFault.exepid process 1588 MSBuild.exe 1588 MSBuild.exe 1588 MSBuild.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tasklist.exeMSBuild.exeWerFault.exedescription pid process Token: SeDebugPrivilege 784 tasklist.exe Token: SeDebugPrivilege 1588 MSBuild.exe Token: SeDebugPrivilege 852 WerFault.exe -
Suspicious use of WriteProcessMemory 41 IoCs
Processes:
osno-crypted.bin.exeMSBuild.execmd.execmd.exeOsno Decryptor.exedescription pid process target process PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe MSBuild.exe PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe MSBuild.exe PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe MSBuild.exe PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe MSBuild.exe PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe MSBuild.exe PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe MSBuild.exe PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe MSBuild.exe PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe MSBuild.exe PID 1668 wrote to memory of 1588 1668 osno-crypted.bin.exe MSBuild.exe PID 1588 wrote to memory of 1228 1588 MSBuild.exe cmd.exe PID 1588 wrote to memory of 1228 1588 MSBuild.exe cmd.exe PID 1588 wrote to memory of 1228 1588 MSBuild.exe cmd.exe PID 1588 wrote to memory of 1228 1588 MSBuild.exe cmd.exe PID 1228 wrote to memory of 1020 1228 cmd.exe chcp.com PID 1228 wrote to memory of 1020 1228 cmd.exe chcp.com PID 1228 wrote to memory of 1020 1228 cmd.exe chcp.com PID 1228 wrote to memory of 1020 1228 cmd.exe chcp.com PID 1228 wrote to memory of 240 1228 cmd.exe netsh.exe PID 1228 wrote to memory of 240 1228 cmd.exe netsh.exe PID 1228 wrote to memory of 240 1228 cmd.exe netsh.exe PID 1228 wrote to memory of 240 1228 cmd.exe netsh.exe PID 1228 wrote to memory of 1472 1228 cmd.exe findstr.exe PID 1228 wrote to memory of 1472 1228 cmd.exe findstr.exe PID 1228 wrote to memory of 1472 1228 cmd.exe findstr.exe PID 1228 wrote to memory of 1472 1228 cmd.exe findstr.exe PID 1588 wrote to memory of 748 1588 MSBuild.exe cmd.exe PID 1588 wrote to memory of 748 1588 MSBuild.exe cmd.exe PID 1588 wrote to memory of 748 1588 MSBuild.exe cmd.exe PID 1588 wrote to memory of 748 1588 MSBuild.exe cmd.exe PID 748 wrote to memory of 784 748 cmd.exe tasklist.exe PID 748 wrote to memory of 784 748 cmd.exe tasklist.exe PID 748 wrote to memory of 784 748 cmd.exe tasklist.exe PID 748 wrote to memory of 784 748 cmd.exe tasklist.exe PID 1588 wrote to memory of 1684 1588 MSBuild.exe Osno Decryptor.exe PID 1588 wrote to memory of 1684 1588 MSBuild.exe Osno Decryptor.exe PID 1588 wrote to memory of 1684 1588 MSBuild.exe Osno Decryptor.exe PID 1588 wrote to memory of 1684 1588 MSBuild.exe Osno Decryptor.exe PID 1684 wrote to memory of 852 1684 Osno Decryptor.exe WerFault.exe PID 1684 wrote to memory of 852 1684 Osno Decryptor.exe WerFault.exe PID 1684 wrote to memory of 852 1684 Osno Decryptor.exe WerFault.exe PID 1684 wrote to memory of 852 1684 Osno Decryptor.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\osno-crypted.bin.exe"C:\Users\Admin\AppData\Local\Temp\osno-crypted.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650014⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile4⤵
-
C:\Windows\SysWOW64\findstr.exefindstr All4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C tasklist /FO TABLE > "C:\Users\Admin\AppData\Local\Temp\3873d8888a3836bc92341667cb978e5e\9965f44e6f4047c4479d448e0c207069\processes.txt"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist /FO TABLE4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Osno Decryptor.exe"C:\Users\Admin\Desktop\Osno Decryptor.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 6564⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\3873d8888a3836bc92341667cb978e5e\9965f44e6f4047c4479d448e0c207069\processes.txtMD5
131a60a8a9f41e89d31e2d29a9db63fe
SHA19fd4759ca90e74d0c512af6ee7df2e03278330bc
SHA256eb6f1266d2416c527960a8ed0536c3b5f0baf73ecf7b6c7d188474a802d30068
SHA51207a5f584c179734c941aa4f15a5700bcd7b3c0f1982162524ca4a860ba6479dad41acfee3ca4620337151e6132742c4b81232d2b5f0e6f4c2eef2e9b96a1f9bc
-
C:\Users\Admin\Desktop\Osno Decryptor.exeMD5
31b725e640371603fc9b006bc4178972
SHA149bfaff98c662dbbc9696f8e43a140480f36207f
SHA25640e4fffa431378e9f09310bba5ff4b8bcec1e11e2b9a606d15f123b696bdb697
SHA5127c2a1a5035fbdfd82353276557a507716095fa81051c9d5daf68f315c4dfa5e1b9ed47eeeb8a52d5d30257b5d14b8b50e83f6fbe64f0e7a4b585012cb032954d
-
C:\Users\Admin\Desktop\Osno Decryptor.exeMD5
31b725e640371603fc9b006bc4178972
SHA149bfaff98c662dbbc9696f8e43a140480f36207f
SHA25640e4fffa431378e9f09310bba5ff4b8bcec1e11e2b9a606d15f123b696bdb697
SHA5127c2a1a5035fbdfd82353276557a507716095fa81051c9d5daf68f315c4dfa5e1b9ed47eeeb8a52d5d30257b5d14b8b50e83f6fbe64f0e7a4b585012cb032954d
-
\Users\Admin\Desktop\Osno Decryptor.exeMD5
31b725e640371603fc9b006bc4178972
SHA149bfaff98c662dbbc9696f8e43a140480f36207f
SHA25640e4fffa431378e9f09310bba5ff4b8bcec1e11e2b9a606d15f123b696bdb697
SHA5127c2a1a5035fbdfd82353276557a507716095fa81051c9d5daf68f315c4dfa5e1b9ed47eeeb8a52d5d30257b5d14b8b50e83f6fbe64f0e7a4b585012cb032954d
-
\Users\Admin\Desktop\Osno Decryptor.exeMD5
31b725e640371603fc9b006bc4178972
SHA149bfaff98c662dbbc9696f8e43a140480f36207f
SHA25640e4fffa431378e9f09310bba5ff4b8bcec1e11e2b9a606d15f123b696bdb697
SHA5127c2a1a5035fbdfd82353276557a507716095fa81051c9d5daf68f315c4dfa5e1b9ed47eeeb8a52d5d30257b5d14b8b50e83f6fbe64f0e7a4b585012cb032954d
-
\Users\Admin\Desktop\Osno Decryptor.exeMD5
31b725e640371603fc9b006bc4178972
SHA149bfaff98c662dbbc9696f8e43a140480f36207f
SHA25640e4fffa431378e9f09310bba5ff4b8bcec1e11e2b9a606d15f123b696bdb697
SHA5127c2a1a5035fbdfd82353276557a507716095fa81051c9d5daf68f315c4dfa5e1b9ed47eeeb8a52d5d30257b5d14b8b50e83f6fbe64f0e7a4b585012cb032954d
-
\Users\Admin\Desktop\Osno Decryptor.exeMD5
31b725e640371603fc9b006bc4178972
SHA149bfaff98c662dbbc9696f8e43a140480f36207f
SHA25640e4fffa431378e9f09310bba5ff4b8bcec1e11e2b9a606d15f123b696bdb697
SHA5127c2a1a5035fbdfd82353276557a507716095fa81051c9d5daf68f315c4dfa5e1b9ed47eeeb8a52d5d30257b5d14b8b50e83f6fbe64f0e7a4b585012cb032954d
-
\Users\Admin\Desktop\Osno Decryptor.exeMD5
31b725e640371603fc9b006bc4178972
SHA149bfaff98c662dbbc9696f8e43a140480f36207f
SHA25640e4fffa431378e9f09310bba5ff4b8bcec1e11e2b9a606d15f123b696bdb697
SHA5127c2a1a5035fbdfd82353276557a507716095fa81051c9d5daf68f315c4dfa5e1b9ed47eeeb8a52d5d30257b5d14b8b50e83f6fbe64f0e7a4b585012cb032954d
-
\Users\Admin\Desktop\Osno Decryptor.exeMD5
31b725e640371603fc9b006bc4178972
SHA149bfaff98c662dbbc9696f8e43a140480f36207f
SHA25640e4fffa431378e9f09310bba5ff4b8bcec1e11e2b9a606d15f123b696bdb697
SHA5127c2a1a5035fbdfd82353276557a507716095fa81051c9d5daf68f315c4dfa5e1b9ed47eeeb8a52d5d30257b5d14b8b50e83f6fbe64f0e7a4b585012cb032954d
-
memory/240-14-0x0000000000000000-mapping.dmp
-
memory/748-16-0x0000000000000000-mapping.dmp
-
memory/784-17-0x0000000000000000-mapping.dmp
-
memory/852-26-0x0000000000000000-mapping.dmp
-
memory/852-37-0x00000000025A0000-0x00000000025B1000-memory.dmpFilesize
68KB
-
memory/852-27-0x0000000001F30000-0x0000000001F41000-memory.dmpFilesize
68KB
-
memory/1020-13-0x0000000000000000-mapping.dmp
-
memory/1228-12-0x0000000000000000-mapping.dmp
-
memory/1472-15-0x0000000000000000-mapping.dmp
-
memory/1588-8-0x0000000000400000-0x00000000004D6000-memory.dmpFilesize
856KB
-
memory/1588-6-0x00000000004D1C3E-mapping.dmp
-
memory/1588-9-0x00000000734B0000-0x0000000073B9E000-memory.dmpFilesize
6.9MB
-
memory/1588-7-0x0000000000400000-0x00000000004D6000-memory.dmpFilesize
856KB
-
memory/1588-5-0x0000000000400000-0x00000000004D6000-memory.dmpFilesize
856KB
-
memory/1668-4-0x00000000046E0000-0x0000000004821000-memory.dmpFilesize
1.3MB
-
memory/1668-0-0x0000000074020000-0x000000007470E000-memory.dmpFilesize
6.9MB
-
memory/1668-3-0x0000000000610000-0x000000000061C000-memory.dmpFilesize
48KB
-
memory/1668-1-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1684-34-0x0000000000000000-mapping.dmp
-
memory/1684-33-0x0000000000000000-mapping.dmp
-
memory/1684-32-0x0000000000000000-mapping.dmp
-
memory/1684-20-0x0000000000000000-mapping.dmp
-
memory/1684-35-0x0000000000000000-mapping.dmp
-
memory/1684-36-0x0000000000000000-mapping.dmp
-
memory/1684-24-0x0000000000D80000-0x0000000000D81000-memory.dmpFilesize
4KB
-
memory/1684-23-0x00000000734B0000-0x0000000073B9E000-memory.dmpFilesize
6.9MB
-
memory/1684-39-0x0000000000000000-mapping.dmp
-
memory/1684-40-0x0000000000000000-mapping.dmp
-
memory/1684-41-0x0000000000000000-mapping.dmp
-
memory/1684-42-0x0000000000000000-mapping.dmp