Analysis
- max time kernel
165s - max time network
187s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
27/01/2022, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
oxc.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
oxc.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target oxc.exe
- Size 664KB
- Sample220127-q2ebbadfbk
- SHA256 76389098be8a410aaf6b21297912f6ef745db6e8a2f2aaaddda8685bd91091c3
- MD5 1d470425e6e769759432b129e3d1e953
- SHA1 092e76ca81792d780c26c7842fd3fc33eb157df9
- SHA512 f346784661b69cc72a57d5fb9694c37e947725574f0ac19db5c21c739ca6a718307afb053694859482d282e9d100d2e1bdc19e194cc2380f753502ecb8e0a135
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3192 ComputerDefaults.exe - Loads dropped DLL 1 IoCs
pid Process 3192 ComputerDefaults.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dkmbwcpqlj = "C:\\Users\\Admin\\Contacts\\jlqpcwbmkD.url" oxc.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1720 1692 WerFault.exe 71 - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1368 PING.EXE - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2636 powershell.exe 2636 powershell.exe 2636 powershell.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe 1720 WerFault.exe - Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 2636 powershell.exe Token: SeRestorePrivilege 1720 WerFault.exe Token: SeBackupPrivilege 1720 WerFault.exe Token: SeIncreaseQuotaPrivilege 2636 powershell.exe Token: SeSecurityPrivilege 2636 powershell.exe Token: SeTakeOwnershipPrivilege 2636 powershell.exe Token: SeLoadDriverPrivilege 2636 powershell.exe Token: SeSystemProfilePrivilege 2636 powershell.exe Token: SeSystemtimePrivilege 2636 powershell.exe Token: SeProfSingleProcessPrivilege 2636 powershell.exe Token: SeIncBasePriorityPrivilege 2636 powershell.exe Token: SeCreatePagefilePrivilege 2636 powershell.exe Token: SeBackupPrivilege 2636 powershell.exe Token: SeRestorePrivilege 2636 powershell.exe Token: SeShutdownPrivilege 2636 powershell.exe Token: SeDebugPrivilege 2636 powershell.exe Token: SeSystemEnvironmentPrivilege 2636 powershell.exe Token: SeRemoteShutdownPrivilege 2636 powershell.exe Token: SeUndockPrivilege 2636 powershell.exe Token: SeManageVolumePrivilege 2636 powershell.exe Token: 33 2636 powershell.exe Token: 34 2636 powershell.exe Token: 35 2636 powershell.exe Token: 36 2636 powershell.exe Token: SeDebugPrivilege 1720 WerFault.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1692 1308 oxc.exe 71 PID 1308 wrote to memory of 1944 1308 oxc.exe 72 PID 1308 wrote to memory of 1944 1308 oxc.exe 72 PID 1308 wrote to memory of 1944 1308 oxc.exe 72 PID 1944 wrote to memory of 2900 1944 cmd.exe 75 PID 1944 wrote to memory of 2900 1944 cmd.exe 75 PID 1944 wrote to memory of 2900 1944 cmd.exe 75 PID 2900 wrote to memory of 3192 2900 cmd.exe 77 PID 2900 wrote to memory of 3192 2900 cmd.exe 77 PID 3192 wrote to memory of 4008 3192 ComputerDefaults.exe 78 PID 3192 wrote to memory of 4008 3192 ComputerDefaults.exe 78 PID 2900 wrote to memory of 1368 2900 cmd.exe 80 PID 2900 wrote to memory of 1368 2900 cmd.exe 80 PID 2900 wrote to memory of 1368 2900 cmd.exe 80 PID 4008 wrote to memory of 2636 4008 cmd.exe 81 PID 4008 wrote to memory of 2636 4008 cmd.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\oxc.exe"C:\Users\Admin\AppData\Local\Temp\oxc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵PID:1692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 4883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Contacts\Dkmbwcpqljt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\Contacts\DkmbwcpqljO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows \System32\ComputerDefaults.exe"C:\Windows \System32\ComputerDefaults.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""5⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 64⤵
- Runs ping.exe
PID:1368
-
-
-