Analysis
-
max time kernel
130s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
17-08-2022 17:55
Static task
static1
Behavioral task
behavioral1
Sample
28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe
Resource
win10v2004-20220812-en
General
-
Target
28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe
-
Size
96KB
-
MD5
d2648d277a22b438236af3bfe5421582
-
SHA1
146489af6ee05c0504bd37896435e03ee0d8f261
-
SHA256
28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642
-
SHA512
9f61b856d199e316ab88578d977950537d87e101c5c33ec857d52688b582f2dbd3b5bcfbb5386bbfb7cd1fc9aaeb3b412a7d603bf31544fe35c4198dfafba1ef
Malware Config
Extracted
netdooka
93.115.21.45
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ougdwieue.exepid process 1052 ougdwieue.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Drops file in Program Files directory 1 IoCs
Processes:
ougdwieue.exedescription ioc process File created C:\Program Files (x86)\SolidTechnology\config.cfg ougdwieue.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1700 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ougdwieue.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ougdwieue.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ougdwieue.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2591564548-2301609547-1748242483-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ougdwieue.exepid process 1052 ougdwieue.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
ougdwieue.exeexplorer.exeAUDIODG.EXEdescription pid process Token: SeDebugPrivilege 1052 ougdwieue.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: 33 1484 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1484 AUDIODG.EXE Token: 33 1484 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1484 AUDIODG.EXE Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe Token: SeShutdownPrivilege 1728 explorer.exe -
Suspicious use of FindShellTrayWindow 23 IoCs
Processes:
explorer.exepid process 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe -
Suspicious use of SendNotifyMessage 15 IoCs
Processes:
explorer.exepid process 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe 1728 explorer.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exeougdwieue.exerunas.exeexplorer.exedescription pid process target process PID 1348 wrote to memory of 1984 1348 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe ping.exe PID 1348 wrote to memory of 1984 1348 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe ping.exe PID 1348 wrote to memory of 1984 1348 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe ping.exe PID 1348 wrote to memory of 1700 1348 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe sc.exe PID 1348 wrote to memory of 1700 1348 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe sc.exe PID 1348 wrote to memory of 1700 1348 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe sc.exe PID 1348 wrote to memory of 1052 1348 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe ougdwieue.exe PID 1348 wrote to memory of 1052 1348 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe ougdwieue.exe PID 1348 wrote to memory of 1052 1348 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe ougdwieue.exe PID 1348 wrote to memory of 1052 1348 28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe ougdwieue.exe PID 1052 wrote to memory of 112 1052 ougdwieue.exe runas.exe PID 1052 wrote to memory of 112 1052 ougdwieue.exe runas.exe PID 1052 wrote to memory of 112 1052 ougdwieue.exe runas.exe PID 1052 wrote to memory of 112 1052 ougdwieue.exe runas.exe PID 112 wrote to memory of 1728 112 runas.exe explorer.exe PID 112 wrote to memory of 1728 112 runas.exe explorer.exe PID 112 wrote to memory of 1728 112 runas.exe explorer.exe PID 112 wrote to memory of 1728 112 runas.exe explorer.exe PID 1728 wrote to memory of 676 1728 explorer.exe ctfmon.exe PID 1728 wrote to memory of 676 1728 explorer.exe ctfmon.exe PID 1728 wrote to memory of 676 1728 explorer.exe ctfmon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe"C:\Users\Admin\AppData\Local\Temp\28ad0bc330c7005637c6241ef5f267981c7b31561dc7d5d5a56e24423b63e642.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\system32\ping.exe"ping.exe" 1.2.3.4 -n 22⤵
- Runs ping.exe
PID:1984
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" start protdrv2⤵
- Launches sc.exe
PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\ougdwieue.exe"C:\Users\Admin\AppData\Local\Temp\\ougdwieue.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\SysWOW64\runas.exerunas /trustlevel:0x20000 C:\Windows\explorer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\explorer.exeC:\Windows\explorer.exe4⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\system32\ctfmon.exectfmon.exe5⤵PID:676
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1081⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD56e5359512d113b246e085e39d9a950d7
SHA1a29470ea2f32ffc8389aba74af1ee26e282ccc9a
SHA256ab7d39e34ad51bc3138fb4d0f7dedc4668be1d4b54a45c385e661869267ef685
SHA512cca7543efb7412a7ced80aa0a9227bdaae5959f7ecafc4a659e0f4d0ddb15e4ed7c7cb07314f04b47211e6c700f005d3aeee06e6eea847398fd804b78f4325d0
-
Filesize
88KB
MD56e5359512d113b246e085e39d9a950d7
SHA1a29470ea2f32ffc8389aba74af1ee26e282ccc9a
SHA256ab7d39e34ad51bc3138fb4d0f7dedc4668be1d4b54a45c385e661869267ef685
SHA512cca7543efb7412a7ced80aa0a9227bdaae5959f7ecafc4a659e0f4d0ddb15e4ed7c7cb07314f04b47211e6c700f005d3aeee06e6eea847398fd804b78f4325d0