Analysis
-
max time kernel
4294225s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
20-03-2022 04:52
Static task
static1
Behavioral task
behavioral1
Sample
1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe
Resource
win10v2004-20220310-en
General
-
Target
1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe
-
Size
15.8MB
-
MD5
f07e973e667b4dde07418f5f99357e92
-
SHA1
9c87c0d4dd7bb0fecc4c9498216ced51f66534b4
-
SHA256
1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af
-
SHA512
dd0fb71bc812ab1950b670a5c08198901d59449da8110de03d396d9093a3772a3335c7b250a677177f60b57e850400180539a1107fcd8afcf892fcdca0909af2
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
OuJP_BsZa.exepid process 1608 OuJP_BsZa.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
OuJP_BsZa.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion OuJP_BsZa.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion OuJP_BsZa.exe -
Loads dropped DLL 7 IoCs
Processes:
1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exeOuJP_BsZa.exepid process 1980 1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe 1980 1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe 1980 1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe 1980 1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
OuJP_BsZa.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run OuJP_BsZa.exe Set value (str) \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Software\Microsoft\Windows\CurrentVersion\Run\soAAjxAu = "C:\\Users\\Public\\Documents\\OuJP_BsZa.exe" OuJP_BsZa.exe -
Processes:
OuJP_BsZa.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA OuJP_BsZa.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
OuJP_BsZa.exepid process 1608 OuJP_BsZa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
OuJP_BsZa.exepid process 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe 1608 OuJP_BsZa.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
OuJP_BsZa.exepid process 1608 OuJP_BsZa.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exedescription pid process target process PID 1980 wrote to memory of 1608 1980 1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe OuJP_BsZa.exe PID 1980 wrote to memory of 1608 1980 1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe OuJP_BsZa.exe PID 1980 wrote to memory of 1608 1980 1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe OuJP_BsZa.exe PID 1980 wrote to memory of 1608 1980 1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe OuJP_BsZa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe"C:\Users\Admin\AppData\Local\Temp\1d0ec3dc89d3abb1d7f692c925fabef2e69cc25e5cd133f3753a131e4178a1af.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Public\Documents\OuJP_BsZa.exe"C:\Users\Public\Documents\OuJP_BsZa.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1608
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\Avira.OE.NativeCore.dllMD5
d1d46e4018c5e3af0beaac36d809cf3c
SHA17928be65a0bb0af8b9085c3b2ac1fcdddeb32919
SHA25682b408b8e66307f6baf6c96503e2cf5032027f0ef237d7a85ed98a83fb4c795f
SHA512f4e101ee66f66abd160badb2d2d73ffaf42e8917b18ac3f1dfa8eca19c89915f5fe4a94676c6f639e72fb34ee229da20518908ee8b159bbc1f9ec1d22fb26d2d
-
C:\Users\Public\Documents\MSVCP120.dllMD5
fd5cabbe52272bd76007b68186ebaf00
SHA1efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA25687c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
SHA5121563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
-
C:\Users\Public\Documents\MSVCR120.dllMD5
034ccadc1c073e4216e9466b720f9849
SHA1f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA25686e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
SHA5125f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
-
C:\Users\Public\Documents\OuJP_BsZa.exeMD5
e4eed381a65c98bb630dfceeeffb9325
SHA1c80a59b23a8e580412728f0e1d12988ecc904a45
SHA256158a3585ba853c9f3d916ea642a49cb26845c695ac5abeea22b4be024f739e4b
SHA512138191a8f44166287cd41638ad460c9f4cce39626235dd30a4cfe8fedf7d7fc13507f931cb8c918b830f87d84baa8b87437a4c81042f622f8c98dc2cb7575937
-
C:\Users\Public\Documents\OuJP_BsZa.exeMD5
e4eed381a65c98bb630dfceeeffb9325
SHA1c80a59b23a8e580412728f0e1d12988ecc904a45
SHA256158a3585ba853c9f3d916ea642a49cb26845c695ac5abeea22b4be024f739e4b
SHA512138191a8f44166287cd41638ad460c9f4cce39626235dd30a4cfe8fedf7d7fc13507f931cb8c918b830f87d84baa8b87437a4c81042f622f8c98dc2cb7575937
-
\Users\Public\Documents\Avira.OE.NativeCore.dllMD5
d1d46e4018c5e3af0beaac36d809cf3c
SHA17928be65a0bb0af8b9085c3b2ac1fcdddeb32919
SHA25682b408b8e66307f6baf6c96503e2cf5032027f0ef237d7a85ed98a83fb4c795f
SHA512f4e101ee66f66abd160badb2d2d73ffaf42e8917b18ac3f1dfa8eca19c89915f5fe4a94676c6f639e72fb34ee229da20518908ee8b159bbc1f9ec1d22fb26d2d
-
\Users\Public\Documents\OuJP_BsZa.exeMD5
e4eed381a65c98bb630dfceeeffb9325
SHA1c80a59b23a8e580412728f0e1d12988ecc904a45
SHA256158a3585ba853c9f3d916ea642a49cb26845c695ac5abeea22b4be024f739e4b
SHA512138191a8f44166287cd41638ad460c9f4cce39626235dd30a4cfe8fedf7d7fc13507f931cb8c918b830f87d84baa8b87437a4c81042f622f8c98dc2cb7575937
-
\Users\Public\Documents\OuJP_BsZa.exeMD5
e4eed381a65c98bb630dfceeeffb9325
SHA1c80a59b23a8e580412728f0e1d12988ecc904a45
SHA256158a3585ba853c9f3d916ea642a49cb26845c695ac5abeea22b4be024f739e4b
SHA512138191a8f44166287cd41638ad460c9f4cce39626235dd30a4cfe8fedf7d7fc13507f931cb8c918b830f87d84baa8b87437a4c81042f622f8c98dc2cb7575937
-
\Users\Public\Documents\OuJP_BsZa.exeMD5
e4eed381a65c98bb630dfceeeffb9325
SHA1c80a59b23a8e580412728f0e1d12988ecc904a45
SHA256158a3585ba853c9f3d916ea642a49cb26845c695ac5abeea22b4be024f739e4b
SHA512138191a8f44166287cd41638ad460c9f4cce39626235dd30a4cfe8fedf7d7fc13507f931cb8c918b830f87d84baa8b87437a4c81042f622f8c98dc2cb7575937
-
\Users\Public\Documents\OuJP_BsZa.exeMD5
e4eed381a65c98bb630dfceeeffb9325
SHA1c80a59b23a8e580412728f0e1d12988ecc904a45
SHA256158a3585ba853c9f3d916ea642a49cb26845c695ac5abeea22b4be024f739e4b
SHA512138191a8f44166287cd41638ad460c9f4cce39626235dd30a4cfe8fedf7d7fc13507f931cb8c918b830f87d84baa8b87437a4c81042f622f8c98dc2cb7575937
-
\Users\Public\Documents\msvcp120.dllMD5
fd5cabbe52272bd76007b68186ebaf00
SHA1efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA25687c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
SHA5121563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
-
\Users\Public\Documents\msvcr120.dllMD5
034ccadc1c073e4216e9466b720f9849
SHA1f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA25686e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
SHA5125f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
-
memory/1608-69-0x0000000000780000-0x0000000006482000-memory.dmpFilesize
93.0MB
-
memory/1608-68-0x0000000077AC0000-0x0000000077C40000-memory.dmpFilesize
1.5MB
-
memory/1608-70-0x0000000000780000-0x0000000006482000-memory.dmpFilesize
93.0MB
-
memory/1608-71-0x0000000000780000-0x0000000006482000-memory.dmpFilesize
93.0MB
-
memory/1608-72-0x0000000000780000-0x0000000006482000-memory.dmpFilesize
93.0MB
-
memory/1608-73-0x0000000000780000-0x0000000006482000-memory.dmpFilesize
93.0MB
-
memory/1608-74-0x0000000000780000-0x0000000006482000-memory.dmpFilesize
93.0MB
-
memory/1608-75-0x0000000000780000-0x0000000006482000-memory.dmpFilesize
93.0MB
-
memory/1608-76-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1980-54-0x00000000767A1000-0x00000000767A3000-memory.dmpFilesize
8KB