Analysis
-
max time kernel
151s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 15:35
Static task
static1
Behavioral task
behavioral1
Sample
6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe
Resource
win10v2004-20220812-en
General
-
Target
6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe
-
Size
212KB
-
MD5
d87c6a24a08e76c890465cbcee424843
-
SHA1
f3c7628ab0dff544030f5b4340f968c8de5c6bf5
-
SHA256
6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f
-
SHA512
01434b56ab8f3a20f1e1bd33afed4e807a238f603de4b913ff29758578041b3ab3db9668bdfe9342a260d26e60f6ad94c8b11aebda664356e2504dad74297655
-
SSDEEP
6144:yYK7alOHRvLWCTnsP2stSINUW0S7+SlXKMK95:6kOHRvLWCTnotSm0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ozogi.exeozogi.exepid process 1280 ozogi.exe 2024 ozogi.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 900 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exepid process 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ozogi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\{6F23BE62-BA00-EA16-FF18-6EAA80F9B1B4} = "C:\\Users\\Admin\\AppData\\Roaming\\Ucsif\\ozogi.exe" ozogi.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\Currentversion\Run ozogi.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exeozogi.exedescription pid process target process PID 1412 set thread context of 1712 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe PID 1280 set thread context of 2024 1280 ozogi.exe ozogi.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
ozogi.exepid process 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe 2024 ozogi.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exedescription pid process Token: SeSecurityPrivilege 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exeozogi.exepid process 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 1280 ozogi.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exeozogi.exeozogi.exedescription pid process target process PID 1412 wrote to memory of 1712 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe PID 1412 wrote to memory of 1712 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe PID 1412 wrote to memory of 1712 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe PID 1412 wrote to memory of 1712 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe PID 1412 wrote to memory of 1712 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe PID 1412 wrote to memory of 1712 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe PID 1412 wrote to memory of 1712 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe PID 1412 wrote to memory of 1712 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe PID 1412 wrote to memory of 1712 1412 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe PID 1712 wrote to memory of 1280 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe ozogi.exe PID 1712 wrote to memory of 1280 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe ozogi.exe PID 1712 wrote to memory of 1280 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe ozogi.exe PID 1712 wrote to memory of 1280 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe ozogi.exe PID 1280 wrote to memory of 2024 1280 ozogi.exe ozogi.exe PID 1280 wrote to memory of 2024 1280 ozogi.exe ozogi.exe PID 1280 wrote to memory of 2024 1280 ozogi.exe ozogi.exe PID 1280 wrote to memory of 2024 1280 ozogi.exe ozogi.exe PID 1280 wrote to memory of 2024 1280 ozogi.exe ozogi.exe PID 1280 wrote to memory of 2024 1280 ozogi.exe ozogi.exe PID 1280 wrote to memory of 2024 1280 ozogi.exe ozogi.exe PID 1280 wrote to memory of 2024 1280 ozogi.exe ozogi.exe PID 1280 wrote to memory of 2024 1280 ozogi.exe ozogi.exe PID 2024 wrote to memory of 1128 2024 ozogi.exe taskhost.exe PID 2024 wrote to memory of 1128 2024 ozogi.exe taskhost.exe PID 1712 wrote to memory of 900 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe cmd.exe PID 1712 wrote to memory of 900 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe cmd.exe PID 1712 wrote to memory of 900 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe cmd.exe PID 1712 wrote to memory of 900 1712 6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe cmd.exe PID 2024 wrote to memory of 1128 2024 ozogi.exe taskhost.exe PID 2024 wrote to memory of 1128 2024 ozogi.exe taskhost.exe PID 2024 wrote to memory of 1128 2024 ozogi.exe taskhost.exe PID 2024 wrote to memory of 1204 2024 ozogi.exe Dwm.exe PID 2024 wrote to memory of 1204 2024 ozogi.exe Dwm.exe PID 2024 wrote to memory of 1204 2024 ozogi.exe Dwm.exe PID 2024 wrote to memory of 1204 2024 ozogi.exe Dwm.exe PID 2024 wrote to memory of 1204 2024 ozogi.exe Dwm.exe PID 2024 wrote to memory of 1268 2024 ozogi.exe Explorer.EXE PID 2024 wrote to memory of 1268 2024 ozogi.exe Explorer.EXE PID 2024 wrote to memory of 1268 2024 ozogi.exe Explorer.EXE PID 2024 wrote to memory of 1268 2024 ozogi.exe Explorer.EXE PID 2024 wrote to memory of 1268 2024 ozogi.exe Explorer.EXE PID 2024 wrote to memory of 556 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 556 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 556 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 556 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 556 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 472 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 472 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 472 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 472 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 472 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 1364 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 1364 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 1364 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 1364 2024 ozogi.exe DllHost.exe PID 2024 wrote to memory of 1364 2024 ozogi.exe DllHost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe"C:\Users\Admin\AppData\Local\Temp\6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe"C:\Users\Admin\AppData\Local\Temp\6e66f19a74227e4c97a836ddcc6d0a73463108ad5f4928daa9ee489f92760b7f.exe"3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Ucsif\ozogi.exe"C:\Users\Admin\AppData\Roaming\Ucsif\ozogi.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Ucsif\ozogi.exe"C:\Users\Admin\AppData\Roaming\Ucsif\ozogi.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp2513b58c.bat"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2513b58c.batFilesize
307B
MD5b4e22490539477e35f1e0815ed722b42
SHA1fb5ae7403e1654a41c40a929f038fe40d0288ca2
SHA256006286489d1995104491626ea1f8b04445cdb69b6dbc2227db6f7c41b85dfac8
SHA512f7539a24dd5b2e2d26147d31ce26b76f84c60ba51bdc3d0c35ddf101f6bddcb612b3f5fc7de018a787c7a05200527da607fe4e266718eb89ac4ecde6990e4e3b
-
C:\Users\Admin\AppData\Roaming\Ucsif\ozogi.exeFilesize
212KB
MD5f8ca325b0f006d416656d74518326b3b
SHA13b148db8ef2a8ecf1ed0dedcf6378a5af6710728
SHA256f2ab319831be354aadce64b40516863235e339384ec944326a0996a5fbec846b
SHA512380784a408ad3f6178f94bdc0cda68e77de5bcacdf24c44ad933ee8f455826a3d937505693d2b1f2679d29004aaccdfdfd032a6cbeaa940dde31bf6da57c1df9
-
C:\Users\Admin\AppData\Roaming\Ucsif\ozogi.exeFilesize
212KB
MD5f8ca325b0f006d416656d74518326b3b
SHA13b148db8ef2a8ecf1ed0dedcf6378a5af6710728
SHA256f2ab319831be354aadce64b40516863235e339384ec944326a0996a5fbec846b
SHA512380784a408ad3f6178f94bdc0cda68e77de5bcacdf24c44ad933ee8f455826a3d937505693d2b1f2679d29004aaccdfdfd032a6cbeaa940dde31bf6da57c1df9
-
C:\Users\Admin\AppData\Roaming\Ucsif\ozogi.exeFilesize
212KB
MD5f8ca325b0f006d416656d74518326b3b
SHA13b148db8ef2a8ecf1ed0dedcf6378a5af6710728
SHA256f2ab319831be354aadce64b40516863235e339384ec944326a0996a5fbec846b
SHA512380784a408ad3f6178f94bdc0cda68e77de5bcacdf24c44ad933ee8f455826a3d937505693d2b1f2679d29004aaccdfdfd032a6cbeaa940dde31bf6da57c1df9
-
\Users\Admin\AppData\Roaming\Ucsif\ozogi.exeFilesize
212KB
MD5f8ca325b0f006d416656d74518326b3b
SHA13b148db8ef2a8ecf1ed0dedcf6378a5af6710728
SHA256f2ab319831be354aadce64b40516863235e339384ec944326a0996a5fbec846b
SHA512380784a408ad3f6178f94bdc0cda68e77de5bcacdf24c44ad933ee8f455826a3d937505693d2b1f2679d29004aaccdfdfd032a6cbeaa940dde31bf6da57c1df9
-
\Users\Admin\AppData\Roaming\Ucsif\ozogi.exeFilesize
212KB
MD5f8ca325b0f006d416656d74518326b3b
SHA13b148db8ef2a8ecf1ed0dedcf6378a5af6710728
SHA256f2ab319831be354aadce64b40516863235e339384ec944326a0996a5fbec846b
SHA512380784a408ad3f6178f94bdc0cda68e77de5bcacdf24c44ad933ee8f455826a3d937505693d2b1f2679d29004aaccdfdfd032a6cbeaa940dde31bf6da57c1df9
-
memory/472-107-0x0000000003A50000-0x0000000003A77000-memory.dmpFilesize
156KB
-
memory/472-106-0x0000000003A50000-0x0000000003A77000-memory.dmpFilesize
156KB
-
memory/472-105-0x0000000003A50000-0x0000000003A77000-memory.dmpFilesize
156KB
-
memory/472-104-0x0000000003A50000-0x0000000003A77000-memory.dmpFilesize
156KB
-
memory/556-100-0x0000000000310000-0x0000000000337000-memory.dmpFilesize
156KB
-
memory/556-101-0x0000000000310000-0x0000000000337000-memory.dmpFilesize
156KB
-
memory/556-99-0x0000000000310000-0x0000000000337000-memory.dmpFilesize
156KB
-
memory/556-98-0x0000000000310000-0x0000000000337000-memory.dmpFilesize
156KB
-
memory/900-78-0x0000000000000000-mapping.dmp
-
memory/1128-79-0x0000000001E60000-0x0000000001E87000-memory.dmpFilesize
156KB
-
memory/1128-80-0x0000000001E60000-0x0000000001E87000-memory.dmpFilesize
156KB
-
memory/1128-77-0x0000000001E60000-0x0000000001E87000-memory.dmpFilesize
156KB
-
memory/1128-76-0x0000000001E60000-0x0000000001E87000-memory.dmpFilesize
156KB
-
memory/1128-74-0x0000000001E60000-0x0000000001E87000-memory.dmpFilesize
156KB
-
memory/1204-86-0x0000000001D60000-0x0000000001D87000-memory.dmpFilesize
156KB
-
memory/1204-87-0x0000000001D60000-0x0000000001D87000-memory.dmpFilesize
156KB
-
memory/1204-88-0x0000000001D60000-0x0000000001D87000-memory.dmpFilesize
156KB
-
memory/1204-84-0x0000000001D60000-0x0000000001D87000-memory.dmpFilesize
156KB
-
memory/1268-91-0x0000000002920000-0x0000000002947000-memory.dmpFilesize
156KB
-
memory/1268-92-0x0000000002920000-0x0000000002947000-memory.dmpFilesize
156KB
-
memory/1268-94-0x0000000002920000-0x0000000002947000-memory.dmpFilesize
156KB
-
memory/1268-93-0x0000000002920000-0x0000000002947000-memory.dmpFilesize
156KB
-
memory/1280-64-0x0000000000000000-mapping.dmp
-
memory/1364-110-0x00000000001B0000-0x00000000001D7000-memory.dmpFilesize
156KB
-
memory/1364-113-0x00000000001B0000-0x00000000001D7000-memory.dmpFilesize
156KB
-
memory/1364-112-0x00000000001B0000-0x00000000001D7000-memory.dmpFilesize
156KB
-
memory/1364-111-0x00000000001B0000-0x00000000001D7000-memory.dmpFilesize
156KB
-
memory/1712-57-0x0000000000413048-mapping.dmp
-
memory/1712-60-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1712-59-0x0000000075771000-0x0000000075773000-memory.dmpFilesize
8KB
-
memory/1712-56-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1712-61-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/1712-81-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/2024-70-0x0000000000413048-mapping.dmp
-
memory/2024-95-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB