Analysis
-
max time kernel
142s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 08:59
Static task
static1
Behavioral task
behavioral1
Sample
8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe
Resource
win10v2004-20220812-en
General
-
Target
8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe
-
Size
45KB
-
MD5
07a412834d3c4b96ac079a4e2cf1c3a0
-
SHA1
26a5398e2d42f9ab73667e38e78bbd6363709355
-
SHA256
8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d
-
SHA512
00d2a067d1f88e8ac66bcb04ad1907fc47eaeb0c7d030b00a1beb6da83e4a1ae7dab8d8d83e3e501bfffb7a3585866f41b0b3293d369311533963c0fcb232bc6
-
SSDEEP
768:DBlMRpTIOV2bvM901W/gj5PV0ygta1aRSgfYLT77PbVAzHDb+znLu/1H5Y:DBCRpcOV2bvTW/stgta1aRX0THsHDb/
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
Processes:
8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe -
Executes dropped EXE 1 IoCs
Processes:
Ogioke32.exepid process 884 Ogioke32.exe -
Loads dropped DLL 2 IoCs
Processes:
8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exepid process 1776 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe 1776 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe -
Drops file in System32 directory 3 IoCs
Processes:
8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exedescription ioc process File created C:\Windows\SysWOW64\Ogioke32.exe 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe File opened for modification C:\Windows\SysWOW64\Ogioke32.exe 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe File created C:\Windows\SysWOW64\Onhnap32.dll 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
Ogioke32.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess Ogioke32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess\BrowseNewProcess = "yes" Ogioke32.exe -
Modifies registry class 6 IoCs
Processes:
8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onhnap32.dll" 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Ogioke32.exepid process 884 Ogioke32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exedescription pid process target process PID 1776 wrote to memory of 884 1776 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe Ogioke32.exe PID 1776 wrote to memory of 884 1776 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe Ogioke32.exe PID 1776 wrote to memory of 884 1776 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe Ogioke32.exe PID 1776 wrote to memory of 884 1776 8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe Ogioke32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe"C:\Users\Admin\AppData\Local\Temp\8285247cf6343e420162f48a986428c3e06aad70284b7497ebda168f1451b00d.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ogioke32.exeC:\Windows\system32\Ogioke32.exe2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Ogioke32.exeFilesize
45KB
MD5210a1dc497644d2a98a307ac1cb563c8
SHA1e52accad3c980382f8bf7e79b13d63507047d29a
SHA25619e75bc317d6a42f71d83e57dde3a6b7e36de082d85a4307b29152b66ad571e1
SHA512e3615015b2e73483584a2a7b1b8c339d1814be8ed3a00c98b7beb6aaae61d036a049819700c447e89eee558cd549c7ad60ea3026ae8281b92c5663f65bbf85c4
-
\Windows\SysWOW64\Ogioke32.exeFilesize
45KB
MD5210a1dc497644d2a98a307ac1cb563c8
SHA1e52accad3c980382f8bf7e79b13d63507047d29a
SHA25619e75bc317d6a42f71d83e57dde3a6b7e36de082d85a4307b29152b66ad571e1
SHA512e3615015b2e73483584a2a7b1b8c339d1814be8ed3a00c98b7beb6aaae61d036a049819700c447e89eee558cd549c7ad60ea3026ae8281b92c5663f65bbf85c4
-
\Windows\SysWOW64\Ogioke32.exeFilesize
45KB
MD5210a1dc497644d2a98a307ac1cb563c8
SHA1e52accad3c980382f8bf7e79b13d63507047d29a
SHA25619e75bc317d6a42f71d83e57dde3a6b7e36de082d85a4307b29152b66ad571e1
SHA512e3615015b2e73483584a2a7b1b8c339d1814be8ed3a00c98b7beb6aaae61d036a049819700c447e89eee558cd549c7ad60ea3026ae8281b92c5663f65bbf85c4
-
memory/884-56-0x0000000000000000-mapping.dmp
-
memory/884-60-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/884-61-0x0000000075521000-0x0000000075523000-memory.dmpFilesize
8KB
-
memory/884-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1776-58-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1776-59-0x0000000000220000-0x000000000024F000-memory.dmpFilesize
188KB