Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 12:16
Static task
static1
Behavioral task
behavioral1
Sample
f373ebb32b2a836b78f932fd436ec49a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f373ebb32b2a836b78f932fd436ec49a.exe
Resource
win10-en-20211208
General
-
Target
f373ebb32b2a836b78f932fd436ec49a.exe
-
Size
492KB
-
MD5
f373ebb32b2a836b78f932fd436ec49a
-
SHA1
fdf344a3d5684433e689b61de782d5bd29f185b9
-
SHA256
47d178214e35dc1d7dca9886abd3fc3e715a934c5e8540e9f0879d5d1c8addee
-
SHA512
b5fadc8d050d2bae9b1f657f33d8b23d6ac0eb39fb962a64059fe5e39c73a85e5f998a53622e06811616c55d037b115a853794841a2f16354b65af3ca1ffdb48
Malware Config
Signatures
-
suricata: ET MALWARE OneLouder EXE download possibly installing Zeus P2P
suricata: ET MALWARE OneLouder EXE download possibly installing Zeus P2P
-
suricata: ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download
suricata: ET MALWARE Probable OneLouder downloader (Zeus P2P) exe download
-
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Request M1
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Request M1
-
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M1
suricata: ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M1
-
Executes dropped EXE 4 IoCs
Processes:
7zz.exeojbkcg.exe111.exe7z.exepid process 604 7zz.exe 896 ojbkcg.exe 1712 111.exe 1752 7z.exe -
Drops startup file 2 IoCs
Processes:
7z.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\╧╘┐¿╟²╢».lnk 7z.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\╧╘┐¿╟²╢».lnk 7z.exe -
Loads dropped DLL 9 IoCs
Processes:
f373ebb32b2a836b78f932fd436ec49a.exeojbkcg.exe111.exe7z.exepid process 740 f373ebb32b2a836b78f932fd436ec49a.exe 740 f373ebb32b2a836b78f932fd436ec49a.exe 740 f373ebb32b2a836b78f932fd436ec49a.exe 896 ojbkcg.exe 1712 111.exe 1712 111.exe 1712 111.exe 1712 111.exe 1752 7z.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
f373ebb32b2a836b78f932fd436ec49a.exepid process 740 f373ebb32b2a836b78f932fd436ec49a.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
7z.exedescription pid process Token: SeRestorePrivilege 1752 7z.exe Token: 35 1752 7z.exe Token: SeSecurityPrivilege 1752 7z.exe Token: SeSecurityPrivilege 1752 7z.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
111.exepid process 1712 111.exe 1712 111.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f373ebb32b2a836b78f932fd436ec49a.exe111.exedescription pid process target process PID 740 wrote to memory of 604 740 f373ebb32b2a836b78f932fd436ec49a.exe 7zz.exe PID 740 wrote to memory of 604 740 f373ebb32b2a836b78f932fd436ec49a.exe 7zz.exe PID 740 wrote to memory of 604 740 f373ebb32b2a836b78f932fd436ec49a.exe 7zz.exe PID 740 wrote to memory of 604 740 f373ebb32b2a836b78f932fd436ec49a.exe 7zz.exe PID 740 wrote to memory of 896 740 f373ebb32b2a836b78f932fd436ec49a.exe ojbkcg.exe PID 740 wrote to memory of 896 740 f373ebb32b2a836b78f932fd436ec49a.exe ojbkcg.exe PID 740 wrote to memory of 896 740 f373ebb32b2a836b78f932fd436ec49a.exe ojbkcg.exe PID 740 wrote to memory of 896 740 f373ebb32b2a836b78f932fd436ec49a.exe ojbkcg.exe PID 1712 wrote to memory of 1752 1712 111.exe 7z.exe PID 1712 wrote to memory of 1752 1712 111.exe 7z.exe PID 1712 wrote to memory of 1752 1712 111.exe 7z.exe PID 1712 wrote to memory of 1752 1712 111.exe 7z.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f373ebb32b2a836b78f932fd436ec49a.exe"C:\Users\Admin\AppData\Local\Temp\f373ebb32b2a836b78f932fd436ec49a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Public\Videos\1643375820\7zz.exe"C:\Users\Public\Videos\1643375820\7zz.exe" X -ep2 C:\Users\Public\Videos\1643375820\1.rar C:\Users\Public\Videos\16433758202⤵
- Executes dropped EXE
PID:604 -
C:\Users\Public\Videos\1643375820\ojbkcg.exe"C:\Users\Public\Videos\1643375820\ojbkcg.exe" -a2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896
-
C:\Users\Public\Documents\auto\111.exe"C:\Users\Public\Documents\auto\111.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\ProgramData\7z.exe"C:\ProgramData\7z.exe" x C:\ProgramData\bb.zip -oC:\Users\Admin\AppData\Roaming\Microsoft\Windows2⤵
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1752
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
9ab5c0bbf40b2e1fc5f29a8e474dd215
SHA11d2716926c3c5086d7d10afdb5964b556e131993
SHA256f169d795ec6f5f75547655c79d359aca5f12834f3d79662865e82af902168f29
SHA5128a596e2aa516d3df834fa79803ace1cb8e2891f3e31876795fa40bda934ff6f97dc5023afcebf9f716c81cce498ce60bf6c1aec2ee079c13d9f534c1fa161f5b
-
MD5
6a9e619a0392bb5918306f7fbaa8c85b
SHA1d18d392e078e703ef7d9ec2a4f2042d7fbbf3863
SHA2563beecf3d764daaffc020ba89dd764b0215fbd360bfc115fbb3880ef0672b98e5
SHA512565c8f27395c41d4778debd0dec63d6fafb703255093d6ad5aea5d8b26f768f8b7ff7b2fa37a710179d3c1c0c0f47075a471c73584eb8941ee38b9ea25dcf809
-
MD5
c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
MD5
c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
MD5
fd6745c7e6659a134b2388b81f743eb8
SHA1175c4e2e49d86f4a84a5fb675a86460cbdd291c0
SHA256793d02326504985024cd6afa21f0e1555855b59bc3a63442f0c51337ba74720a
SHA51224611c0e585d330ff82561f3586aaa57b07c044dafd1d0513e2257ec53a4eb63a9989be2112e1c0ac5d20e62a2e3ebaa932bfa4c3e5c29d4c8aef68542c3e0f1
-
MD5
5ecefaea48c5a8498b036acd8ce411a5
SHA1501b3ed0fb6c33f6a122d603292d7fe04e8ce04f
SHA25688dd42dedc77e8ad117cc54d7b37083bbacaa6ecb84553bda31905b0a29e0e4d
SHA512e41a6bb1c734330dac37b9e7552053efdb46d15bf60601613baf8b5ab4be352c4d2f2d1c4e8bc4fe1616b98adfcf7b26336300b3bb724a9016e04d5820b2dd00
-
MD5
26d1f8cc33a7567463bfaebc2242833c
SHA11bd4fa5729c289a3ca1c4955f52464e4cc5ec4da
SHA256cb201744a0f50e72ee4fda9298785fa16bfc4bf639a9474457e429278ff376bc
SHA51201b3909272b3b25a9601cef11fd1122660a56b5220e8b3187c1b27135a23cc9aee9926761ce64ca9d8d872719da420131d83d4556c6255d20579be28d274b445
-
MD5
26d1f8cc33a7567463bfaebc2242833c
SHA11bd4fa5729c289a3ca1c4955f52464e4cc5ec4da
SHA256cb201744a0f50e72ee4fda9298785fa16bfc4bf639a9474457e429278ff376bc
SHA51201b3909272b3b25a9601cef11fd1122660a56b5220e8b3187c1b27135a23cc9aee9926761ce64ca9d8d872719da420131d83d4556c6255d20579be28d274b445
-
MD5
ee5768d7d9e319e36f17476d12450785
SHA1e08648361310618ea81b793411def40cef9e1745
SHA256e21a77a762b943102a0bd1cd9909b4f2c310889b1e3144a1a1e39fc4f09667bf
SHA512daff15ba6de59d2078dcaee5c381a71c2047bc18782a442c6c9ed83fcea3cb3f00f7a99ddf3092785fd7d7d8b70ee1009a717845074d354ebecac484442dae06
-
MD5
4ff2a1da304c3b06f05d3a6680b7da0b
SHA1fcb2b4b36942c0c1468ee51e9bf00d601af6baa7
SHA256da7d3f08ced662147da10d43d9cf8b567db2c87f2e4106435c3734e39791b5ed
SHA512a7e68f72a50d2b0ea57b556b73d83245de08e69d63f824ed0bdfc08bdf82302f7f367963d26382ec2a4ed859b900ed542f1bb527a3608a6a0e60f7ad952bbf74
-
MD5
b6ee97ccbebb6c4d06e1a7a7bb4ee1c8
SHA17451e21a49529eb7e42fc5fc03d6980fabc00c44
SHA25687d3ea42604943d2230cc0b5aea499da41fc7db46d141abf96875692040e4699
SHA512060d9790e31c71e9e9b3d132088c107a6ae79a707ae3654b4c7e5a9248fd610761c0c40c54f4930d36c0379b490e7bee1be5592da85e4fe4c3f5c4a1a2eddd12
-
MD5
f2ae502d448cfb81a5f40a9368d99b1a
SHA1f849be86e9e7ced0acd51a68f92992b8090d08a5
SHA25607ad4b984f288304003b080dd013784685181de4353a0b70a0247f96e535bd56
SHA5129f3aea471684e22bf9fc045ca0e47a8429fa0b13c188f9c7a51937efa8afcec976761b0c4c95aed7735096fcc2278bbd86b0ab581261a6aff6c694d7bb65e9be
-
MD5
fb08e726e7a526d4620b4093d3b3cd41
SHA109d800bd9da9f4ce0b372423527925742b001d95
SHA2566aafac6b731ccae8a5f184d692076f5582d6af6459cdbd46299b2fd5bcf60f2b
SHA5126c74b1a879460576a1917e155a010d528458958ae468a25c56781c0d5cc19a97b0bb7434523765d3591e6ccf60588e970558b8acbc62f7446b8b6145c2356c6c
-
MD5
fb08e726e7a526d4620b4093d3b3cd41
SHA109d800bd9da9f4ce0b372423527925742b001d95
SHA2566aafac6b731ccae8a5f184d692076f5582d6af6459cdbd46299b2fd5bcf60f2b
SHA5126c74b1a879460576a1917e155a010d528458958ae468a25c56781c0d5cc19a97b0bb7434523765d3591e6ccf60588e970558b8acbc62f7446b8b6145c2356c6c
-
MD5
c36bb659f08f046b139c8d1b980bf1ac
SHA1dd3247b225a8da3161f76055f31cbc5f64a66086
SHA256405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4
SHA5123eeae6a3b424fa1709b4443f625ee99fa2d2861661214b868d36bf5a63c0aaac61ad3bdd9c4b18cb9d820ef89653787df812289d31d65415c4dd08fd45d0c73f
-
MD5
5ecefaea48c5a8498b036acd8ce411a5
SHA1501b3ed0fb6c33f6a122d603292d7fe04e8ce04f
SHA25688dd42dedc77e8ad117cc54d7b37083bbacaa6ecb84553bda31905b0a29e0e4d
SHA512e41a6bb1c734330dac37b9e7552053efdb46d15bf60601613baf8b5ab4be352c4d2f2d1c4e8bc4fe1616b98adfcf7b26336300b3bb724a9016e04d5820b2dd00
-
MD5
6a9e619a0392bb5918306f7fbaa8c85b
SHA1d18d392e078e703ef7d9ec2a4f2042d7fbbf3863
SHA2563beecf3d764daaffc020ba89dd764b0215fbd360bfc115fbb3880ef0672b98e5
SHA512565c8f27395c41d4778debd0dec63d6fafb703255093d6ad5aea5d8b26f768f8b7ff7b2fa37a710179d3c1c0c0f47075a471c73584eb8941ee38b9ea25dcf809
-
MD5
c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
MD5
c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
MD5
c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
MD5
c808d5b1f96af6f1869d6b6cdbeffd20
SHA17818808f9f3f9719420d160f9c842a84eabdf73e
SHA256921226944015f01f2780179690b7bfcee7b92ea452fe85cae9375e49d64ee0b4
SHA512f89a936640d96e92a86fe0c84dbf3273343faf8850e691b750c916afcc4f0ac49ebe985f97279bd8033254c63eff4319721556d04491218448db992823aebe01
-
MD5
b6ee97ccbebb6c4d06e1a7a7bb4ee1c8
SHA17451e21a49529eb7e42fc5fc03d6980fabc00c44
SHA25687d3ea42604943d2230cc0b5aea499da41fc7db46d141abf96875692040e4699
SHA512060d9790e31c71e9e9b3d132088c107a6ae79a707ae3654b4c7e5a9248fd610761c0c40c54f4930d36c0379b490e7bee1be5592da85e4fe4c3f5c4a1a2eddd12
-
MD5
f2ae502d448cfb81a5f40a9368d99b1a
SHA1f849be86e9e7ced0acd51a68f92992b8090d08a5
SHA25607ad4b984f288304003b080dd013784685181de4353a0b70a0247f96e535bd56
SHA5129f3aea471684e22bf9fc045ca0e47a8429fa0b13c188f9c7a51937efa8afcec976761b0c4c95aed7735096fcc2278bbd86b0ab581261a6aff6c694d7bb65e9be
-
MD5
fb08e726e7a526d4620b4093d3b3cd41
SHA109d800bd9da9f4ce0b372423527925742b001d95
SHA2566aafac6b731ccae8a5f184d692076f5582d6af6459cdbd46299b2fd5bcf60f2b
SHA5126c74b1a879460576a1917e155a010d528458958ae468a25c56781c0d5cc19a97b0bb7434523765d3591e6ccf60588e970558b8acbc62f7446b8b6145c2356c6c
-
MD5
fb08e726e7a526d4620b4093d3b3cd41
SHA109d800bd9da9f4ce0b372423527925742b001d95
SHA2566aafac6b731ccae8a5f184d692076f5582d6af6459cdbd46299b2fd5bcf60f2b
SHA5126c74b1a879460576a1917e155a010d528458958ae468a25c56781c0d5cc19a97b0bb7434523765d3591e6ccf60588e970558b8acbc62f7446b8b6145c2356c6c