Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 21:50
Static task
static1
Behavioral task
behavioral1
Sample
0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe
Resource
win10v2004-20221111-en
General
-
Target
0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe
-
Size
310KB
-
MD5
a7b099621c6bdd4099a2188d8a5bacfe
-
SHA1
687a3330f2b29ee12bf763053f6eb623902368fd
-
SHA256
0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8
-
SHA512
1027e07401b3345e253b62cb642a0e3db0f9724abbfbe5fc20ce2a1faf63602d9efb749394a78bb2341b050c467b2a0f4779fb93d00730b4fdcb5a1e1a34771c
-
SSDEEP
6144:siXdpfjUWlJgwzYfyeivDTCoEAw6hPT6ZKj+nQ0ijGwpQiI8yJngYjQ8pwRy3:siXdyWEZfyhDGxG2sjN0ijGKRI8y2Ylh
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ovhisu.exepid process 1656 ovhisu.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 840 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exepid process 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ovhisu.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run ovhisu.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ovhisu = "C:\\Users\\Admin\\AppData\\Roaming\\Zuzi\\ovhisu.exe" ovhisu.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exedescription pid process target process PID 1112 set thread context of 840 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe cmd.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
ovhisu.exepid process 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe 1656 ovhisu.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exeovhisu.exedescription pid process target process PID 1112 wrote to memory of 1656 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe ovhisu.exe PID 1112 wrote to memory of 1656 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe ovhisu.exe PID 1112 wrote to memory of 1656 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe ovhisu.exe PID 1112 wrote to memory of 1656 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe ovhisu.exe PID 1656 wrote to memory of 1144 1656 ovhisu.exe taskhost.exe PID 1656 wrote to memory of 1144 1656 ovhisu.exe taskhost.exe PID 1656 wrote to memory of 1144 1656 ovhisu.exe taskhost.exe PID 1656 wrote to memory of 1144 1656 ovhisu.exe taskhost.exe PID 1656 wrote to memory of 1144 1656 ovhisu.exe taskhost.exe PID 1656 wrote to memory of 1240 1656 ovhisu.exe Dwm.exe PID 1656 wrote to memory of 1240 1656 ovhisu.exe Dwm.exe PID 1656 wrote to memory of 1240 1656 ovhisu.exe Dwm.exe PID 1656 wrote to memory of 1240 1656 ovhisu.exe Dwm.exe PID 1656 wrote to memory of 1240 1656 ovhisu.exe Dwm.exe PID 1656 wrote to memory of 1272 1656 ovhisu.exe Explorer.EXE PID 1656 wrote to memory of 1272 1656 ovhisu.exe Explorer.EXE PID 1656 wrote to memory of 1272 1656 ovhisu.exe Explorer.EXE PID 1656 wrote to memory of 1272 1656 ovhisu.exe Explorer.EXE PID 1656 wrote to memory of 1272 1656 ovhisu.exe Explorer.EXE PID 1656 wrote to memory of 1112 1656 ovhisu.exe 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe PID 1656 wrote to memory of 1112 1656 ovhisu.exe 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe PID 1656 wrote to memory of 1112 1656 ovhisu.exe 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe PID 1656 wrote to memory of 1112 1656 ovhisu.exe 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe PID 1656 wrote to memory of 1112 1656 ovhisu.exe 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe PID 1112 wrote to memory of 840 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe cmd.exe PID 1112 wrote to memory of 840 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe cmd.exe PID 1112 wrote to memory of 840 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe cmd.exe PID 1112 wrote to memory of 840 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe cmd.exe PID 1112 wrote to memory of 840 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe cmd.exe PID 1112 wrote to memory of 840 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe cmd.exe PID 1112 wrote to memory of 840 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe cmd.exe PID 1112 wrote to memory of 840 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe cmd.exe PID 1112 wrote to memory of 840 1112 0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe"C:\Users\Admin\AppData\Local\Temp\0955e1e7dfba12be75f1f0aef07bbcba6aa88857f81c8f9934662d282f624fd8.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Roaming\Zuzi\ovhisu.exe"C:\Users\Admin\AppData\Roaming\Zuzi\ovhisu.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\PSL13BA.bat"3⤵
- Deletes itself
PID:840
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1240
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1144
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\PSL13BA.batFilesize
303B
MD50f4d418c5fe328134fd13087c03feb5c
SHA1bf2c78a07a179f7b30de777d201d90db33a3dfa3
SHA2563b57b5beb74242bd88661bb932a32d8dee6a2b88da53d3ff3f1fe93f30b19630
SHA512390da958a4fb279f6de74561e4088f9d082c539dde7463bca39921130c75746f5629189b8d6101510b3ebf7ff584bf8fac91e6e19ad399df7416f6d464ebc6ef
-
C:\Users\Admin\AppData\Roaming\Zuzi\ovhisu.exeFilesize
310KB
MD5af52117ae36ee778f6bd6c5bf138cc6f
SHA1d2b93488efd278a61f664359470f9cd0cc1e57ef
SHA256f0725e6d5160cc63f5639f186457523bbfd998972196adc5ad7b0d8f06c5270e
SHA51241970090c6c8871640c4b9ee61495db18040f4382b9ce222cda9cc88dab69ba88fc868a7d3d0f2f766728749f720c07db3579e7ecd1995f1be7c3941efefbe53
-
C:\Users\Admin\AppData\Roaming\Zuzi\ovhisu.exeFilesize
310KB
MD5af52117ae36ee778f6bd6c5bf138cc6f
SHA1d2b93488efd278a61f664359470f9cd0cc1e57ef
SHA256f0725e6d5160cc63f5639f186457523bbfd998972196adc5ad7b0d8f06c5270e
SHA51241970090c6c8871640c4b9ee61495db18040f4382b9ce222cda9cc88dab69ba88fc868a7d3d0f2f766728749f720c07db3579e7ecd1995f1be7c3941efefbe53
-
\Users\Admin\AppData\Roaming\Zuzi\ovhisu.exeFilesize
310KB
MD5af52117ae36ee778f6bd6c5bf138cc6f
SHA1d2b93488efd278a61f664359470f9cd0cc1e57ef
SHA256f0725e6d5160cc63f5639f186457523bbfd998972196adc5ad7b0d8f06c5270e
SHA51241970090c6c8871640c4b9ee61495db18040f4382b9ce222cda9cc88dab69ba88fc868a7d3d0f2f766728749f720c07db3579e7ecd1995f1be7c3941efefbe53
-
\Users\Admin\AppData\Roaming\Zuzi\ovhisu.exeFilesize
310KB
MD5af52117ae36ee778f6bd6c5bf138cc6f
SHA1d2b93488efd278a61f664359470f9cd0cc1e57ef
SHA256f0725e6d5160cc63f5639f186457523bbfd998972196adc5ad7b0d8f06c5270e
SHA51241970090c6c8871640c4b9ee61495db18040f4382b9ce222cda9cc88dab69ba88fc868a7d3d0f2f766728749f720c07db3579e7ecd1995f1be7c3941efefbe53
-
memory/840-110-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/840-111-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/840-113-0x0000000000050000-0x0000000000099000-memory.dmpFilesize
292KB
-
memory/840-97-0x0000000000050000-0x0000000000099000-memory.dmpFilesize
292KB
-
memory/840-109-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/840-108-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/840-107-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/840-106-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/840-105-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/840-102-0x0000000000083B6A-mapping.dmp
-
memory/840-101-0x0000000000050000-0x0000000000099000-memory.dmpFilesize
292KB
-
memory/840-99-0x0000000000050000-0x0000000000099000-memory.dmpFilesize
292KB
-
memory/840-100-0x0000000000050000-0x0000000000099000-memory.dmpFilesize
292KB
-
memory/1112-85-0x0000000000450000-0x0000000000499000-memory.dmpFilesize
292KB
-
memory/1112-103-0x0000000000450000-0x0000000000499000-memory.dmpFilesize
292KB
-
memory/1112-54-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1112-56-0x0000000074D61000-0x0000000074D63000-memory.dmpFilesize
8KB
-
memory/1112-55-0x0000000000401000-0x0000000000442000-memory.dmpFilesize
260KB
-
memory/1112-86-0x0000000000450000-0x0000000000499000-memory.dmpFilesize
292KB
-
memory/1112-87-0x0000000000450000-0x0000000000499000-memory.dmpFilesize
292KB
-
memory/1112-88-0x0000000000450000-0x0000000000499000-memory.dmpFilesize
292KB
-
memory/1112-89-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1112-90-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1112-91-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1112-92-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1112-93-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1112-94-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/1144-68-0x0000000001EC0000-0x0000000001F09000-memory.dmpFilesize
292KB
-
memory/1144-65-0x0000000001EC0000-0x0000000001F09000-memory.dmpFilesize
292KB
-
memory/1144-67-0x0000000001EC0000-0x0000000001F09000-memory.dmpFilesize
292KB
-
memory/1144-70-0x0000000001EC0000-0x0000000001F09000-memory.dmpFilesize
292KB
-
memory/1144-69-0x0000000001EC0000-0x0000000001F09000-memory.dmpFilesize
292KB
-
memory/1240-73-0x00000000001A0000-0x00000000001E9000-memory.dmpFilesize
292KB
-
memory/1240-75-0x00000000001A0000-0x00000000001E9000-memory.dmpFilesize
292KB
-
memory/1240-76-0x00000000001A0000-0x00000000001E9000-memory.dmpFilesize
292KB
-
memory/1240-74-0x00000000001A0000-0x00000000001E9000-memory.dmpFilesize
292KB
-
memory/1272-79-0x0000000002630000-0x0000000002679000-memory.dmpFilesize
292KB
-
memory/1272-80-0x0000000002630000-0x0000000002679000-memory.dmpFilesize
292KB
-
memory/1272-82-0x0000000002630000-0x0000000002679000-memory.dmpFilesize
292KB
-
memory/1272-81-0x0000000002630000-0x0000000002679000-memory.dmpFilesize
292KB
-
memory/1656-62-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/1656-59-0x0000000000000000-mapping.dmp