Overview
overview
8Static
static
3Amazon___D...en.rar
windows7-x64
3Amazon___D...en.rar
windows10-2004-x64
3Amazon & D...ibutes
windows7-x64
1Amazon & D...ibutes
windows10-2004-x64
1Amazon & D...et.dll
windows7-x64
1Amazon & D...et.dll
windows10-2004-x64
1Amazon & D...ICENSE
windows7-x64
1Amazon & D...ICENSE
windows10-2004-x64
1Amazon & D...E!.txt
windows7-x64
1Amazon & D...E!.txt
windows10-2004-x64
1Amazon & D...en.exe
windows7-x64
8Amazon & D...en.exe
windows10-2004-x64
8Amazon & D...op.ini
windows7-x64
1Amazon & D...op.ini
windows10-2004-x64
1Amazon & D...an.txt
windows7-x64
1Amazon & D...an.txt
windows10-2004-x64
1Amazon & D...er.dll
windows7-x64
1Amazon & D...er.dll
windows10-2004-x64
1Amazon & D...it.dll
windows7-x64
1Amazon & D...it.dll
windows10-2004-x64
1Amazon & D...ip.dll
windows7-x64
1Amazon & D...ip.dll
windows10-2004-x64
1Amazon & D...CE.zip
windows7-x64
1Amazon & D...CE.zip
windows10-2004-x64
1Amazon & D...er.exe
windows7-x64
8Amazon & D...er.exe
windows10-2004-x64
8Amazon & D...E!.txt
windows7-x64
1Amazon & D...E!.txt
windows10-2004-x64
1Amazon & D...it.dll
windows7-x64
1Amazon & D...it.dll
windows10-2004-x64
1Amazon & D...db.exe
windows7-x64
7Amazon & D...db.exe
windows10-2004-x64
7Resubmissions
26-09-2022 21:20
220926-z66e2acab9 8Analysis
-
max time kernel
50s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-09-2022 21:20
Behavioral task
behavioral1
Sample
Amazon___Dicord_Gen_By_ShadowOxygen.rar
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Amazon___Dicord_Gen_By_ShadowOxygen.rar
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Amazon & Dicord Gen By ShadowOxygen/.gitattributes
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Amazon & Dicord Gen By ShadowOxygen/.gitattributes
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Amazon & Dicord Gen By ShadowOxygen/Extreme.Net.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
Amazon & Dicord Gen By ShadowOxygen/Extreme.Net.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
Amazon & Dicord Gen By ShadowOxygen/LICENSE
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
Amazon & Dicord Gen By ShadowOxygen/LICENSE
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Amazon & Dicord Gen By ShadowOxygen/README!.txt
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
Amazon & Dicord Gen By ShadowOxygen/README!.txt
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Amazon & Dicord Gen By ShadowOxygen/ShadowGen.exe
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
Amazon & Dicord Gen By ShadowOxygen/ShadowGen.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
Amazon & Dicord Gen By ShadowOxygen/Virus Total/desktop.ini
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Amazon & Dicord Gen By ShadowOxygen/Virus Total/desktop.ini
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
Amazon & Dicord Gen By ShadowOxygen/Virus Total/scan.txt
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Amazon & Dicord Gen By ShadowOxygen/Virus Total/scan.txt
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
Amazon & Dicord Gen By ShadowOxygen/WebDriver.dll
Resource
win7-20220901-en
Behavioral task
behavioral18
Sample
Amazon & Dicord Gen By ShadowOxygen/WebDriver.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
Amazon & Dicord Gen By ShadowOxygen/Xceed.Wpf.Toolkit.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
Amazon & Dicord Gen By ShadowOxygen/Xceed.Wpf.Toolkit.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Ionic.Zip.dll
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Ionic.Zip.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/LICENCE.zip
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/LICENCE.zip
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Launcher.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Launcher.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/README!.txt
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/README!.txt
Resource
win10v2004-20220901-en
Behavioral task
behavioral29
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Xceed.Wpf.Toolkit.dll
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/Xceed.Wpf.Toolkit.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/db.exe
Resource
win7-20220901-en
Behavioral task
behavioral32
Sample
Amazon & Dicord Gen By ShadowOxygen/bin/db.exe
Resource
win10v2004-20220901-en
General
-
Target
Amazon___Dicord_Gen_By_ShadowOxygen.rar
-
Size
7.1MB
-
MD5
219041f378ad512a44b2922409c02b3a
-
SHA1
d31211d066b1aba5d56940941e0323ab419aea1b
-
SHA256
2e93eec9d4641c99970e8301a6954845eb99b30e059d8b02452b57524245e81c
-
SHA512
2dc77e4d3ff59e7fd7009c5f80976415069da89a2d8017d7de6a6e1b09a4a74a62c883dddf78a15fe3c53f4968e9d61a203ebee6975809d829bc181fd9e4e237
-
SSDEEP
98304:1o9YsV8WCDA+LVz05NhCe/mq8lJFSXJnza7FR1a8eJto9hn+oOQaTK+MUzbWE9p:1o99eV4NhzZsFSVzaM+9hn+oOH5zv
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 5024 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Amazon___Dicord_Gen_By_ShadowOxygen.rar1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx