Analysis
-
max time kernel
128s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 08:46
Static task
static1
Behavioral task
behavioral1
Sample
5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe
Resource
win10v2004-20220812-en
General
-
Target
5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe
-
Size
689KB
-
MD5
7305e7d72a3143abc5a7cd636300ec62
-
SHA1
25c657e556b16098d7738e6e17670f022384bdef
-
SHA256
5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a
-
SHA512
7c3dd25bad0d5ff1d6d6331eebe4a3e3bb19060f5cc20b9f97e665913dd2042dda982390f7c02e0be207c0d60fa9353ab7c616b54ecd3db04028ee33ab4a7e7f
-
SSDEEP
12288:x+Mhgdjf1Png+/Sjz9aTb7kJ428zbOOTBQxx+B9MdRIcTEpQLw/RKDbFTJ:fET1PrSj5sbi4bH3AQEAl5sbFT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
OTVbfjlm.exepid process 4408 OTVbfjlm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OTVbfjlm = "\"C:\\Program Files\\OTVbfjlm.exe\"" 5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\windows\CurrentVersion\Run 5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe -
Drops file in Program Files directory 2 IoCs
Processes:
5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exedescription ioc process File created C:\Program Files\OTVbfjlm.exe 5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe File opened for modification C:\Program Files\OTVbfjlm.exe 5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
OTVbfjlm.exedescription pid process Token: SeIncBasePriorityPrivilege 4408 OTVbfjlm.exe Token: SeIncBasePriorityPrivilege 4408 OTVbfjlm.exe Token: SeIncBasePriorityPrivilege 4408 OTVbfjlm.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exedescription pid process target process PID 976 wrote to memory of 4408 976 5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe OTVbfjlm.exe PID 976 wrote to memory of 4408 976 5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe OTVbfjlm.exe PID 976 wrote to memory of 4408 976 5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe OTVbfjlm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe"C:\Users\Admin\AppData\Local\Temp\5f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a.exe"1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Program Files\OTVbfjlm.exe"C:\Program Files\OTVbfjlm.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4408
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\OTVbfjlm.exeFilesize
689KB
MD57305e7d72a3143abc5a7cd636300ec62
SHA125c657e556b16098d7738e6e17670f022384bdef
SHA2565f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a
SHA5127c3dd25bad0d5ff1d6d6331eebe4a3e3bb19060f5cc20b9f97e665913dd2042dda982390f7c02e0be207c0d60fa9353ab7c616b54ecd3db04028ee33ab4a7e7f
-
C:\Program Files\OTVbfjlm.exeFilesize
689KB
MD57305e7d72a3143abc5a7cd636300ec62
SHA125c657e556b16098d7738e6e17670f022384bdef
SHA2565f3f31a051cd1114282d6b1e1340889eeab433cb6e243036a0f0f1ecc918fd6a
SHA5127c3dd25bad0d5ff1d6d6331eebe4a3e3bb19060f5cc20b9f97e665913dd2042dda982390f7c02e0be207c0d60fa9353ab7c616b54ecd3db04028ee33ab4a7e7f
-
memory/4408-132-0x0000000000000000-mapping.dmp