Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
26-07-2022 18:36
Static task
static1
Behavioral task
behavioral1
Sample
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe
Resource
win10v2004-20220721-en
General
-
Target
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe
-
Size
470KB
-
MD5
b0d0a4af8f13d80eafe1238bd3f684c8
-
SHA1
23f10ff96e9933590fb9c384c543d20ab695733f
-
SHA256
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5af557b4f09d698b8145
-
SHA512
5c5297e21c1a37d72894cd232a0833c917d886fb2f8aae9015a41b986a8c4738d90372181cfad5d1bb2584e9b4fbfa2a719752f2973629e42cd562487cdbeffd
Malware Config
Extracted
oski
manguerassorna.com
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\wınrarçexe = "\"C:\\Users\\Admin\\AppData\\Roaming\\wınrarçexe.exe\"" 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exedescription pid process target process PID 908 set thread context of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 868 1992 WerFault.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exe938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exepid process 956 powershell.exe 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exe938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exedescription pid process Token: SeDebugPrivilege 956 powershell.exe Token: SeDebugPrivilege 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exeInstallUtil.exedescription pid process target process PID 908 wrote to memory of 956 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe powershell.exe PID 908 wrote to memory of 956 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe powershell.exe PID 908 wrote to memory of 956 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe powershell.exe PID 908 wrote to memory of 956 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe powershell.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 908 wrote to memory of 1992 908 938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe InstallUtil.exe PID 1992 wrote to memory of 868 1992 InstallUtil.exe WerFault.exe PID 1992 wrote to memory of 868 1992 InstallUtil.exe WerFault.exe PID 1992 wrote to memory of 868 1992 InstallUtil.exe WerFault.exe PID 1992 wrote to memory of 868 1992 InstallUtil.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe"C:\Users\Admin\AppData\Local\Temp\938f4e648e57b9ad6d41ea3fe8707c0f249ba2baa24a5.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 7163⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/868-78-0x0000000000000000-mapping.dmp
-
memory/908-55-0x00000000007A0000-0x000000000080E000-memory.dmpFilesize
440KB
-
memory/908-56-0x0000000004740000-0x00000000047D2000-memory.dmpFilesize
584KB
-
memory/908-57-0x0000000075D21000-0x0000000075D23000-memory.dmpFilesize
8KB
-
memory/908-54-0x0000000000820000-0x0000000000898000-memory.dmpFilesize
480KB
-
memory/956-58-0x0000000000000000-mapping.dmp
-
memory/956-60-0x000000006F2D0000-0x000000006F87B000-memory.dmpFilesize
5.7MB
-
memory/956-61-0x000000006F2D0000-0x000000006F87B000-memory.dmpFilesize
5.7MB
-
memory/956-62-0x000000006F2D0000-0x000000006F87B000-memory.dmpFilesize
5.7MB
-
memory/1992-63-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-66-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-68-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-70-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-72-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-73-0x000000000040717B-mapping.dmp
-
memory/1992-75-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-77-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-64-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1992-79-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB