Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 08:59
Static task
static1
Behavioral task
behavioral1
Sample
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe
Resource
win10v2004-20220812-en
General
-
Target
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe
-
Size
45KB
-
MD5
ae0322d5bec92f0f3f9d8f82075418a0
-
SHA1
b1b92bf3443b58cc7d19c36b39335dab1722db4a
-
SHA256
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9
-
SHA512
ea4bc0ac10c8c5697e511b5fbe30e3df8ae8bf7a251281095d551f1e37d82294e4371165669856369767aaf1a6d55f8623f9eacedb2a4ca6fe8a6f58d6e2b993
-
SSDEEP
768:4gjHnA1QTUe39+p5HbTawMoEsoGFynnaS/FO/1H5/:4gkGTUe39a5HHzQshMahh
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 2 IoCs
Processes:
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe -
Executes dropped EXE 1 IoCs
Processes:
Ooagcl32.exepid process 1664 Ooagcl32.exe -
Drops file in System32 directory 3 IoCs
Processes:
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exedescription ioc process File created C:\Windows\SysWOW64\Ooagcl32.exe 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe File opened for modification C:\Windows\SysWOW64\Ooagcl32.exe 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe File created C:\Windows\SysWOW64\Knakdgdk.dll 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
Ooagcl32.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess Ooagcl32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess\BrowseNewProcess = "yes" Ooagcl32.exe -
Modifies registry class 6 IoCs
Processes:
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knakdgdk.dll" 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Ooagcl32.exepid process 1664 Ooagcl32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exedescription pid process target process PID 1956 wrote to memory of 1664 1956 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Ooagcl32.exe PID 1956 wrote to memory of 1664 1956 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Ooagcl32.exe PID 1956 wrote to memory of 1664 1956 1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe Ooagcl32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe"C:\Users\Admin\AppData\Local\Temp\1a973364de609793385448417bd991bcd912cffa3aaa88383c89707df1c48fb9.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ooagcl32.exeC:\Windows\system32\Ooagcl32.exe2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Ooagcl32.exeFilesize
45KB
MD59155eb452350acf455d28a3106a7f887
SHA1774031a5bf0c329c796fe905fe6cf49fd77f1bd4
SHA25650b9d89aca736ac2dcbe42ac064ed441b359f6f532057d821b7d614ee10b8374
SHA512357d115b18d40b4300071ee05e1021abf3a8b5dd6bc21f2e0fa6546eff27e02c529780535b4cbebd54cd80a6193ab035d3d8e2217125025b95adb198f77be605
-
C:\Windows\SysWOW64\Ooagcl32.exeFilesize
45KB
MD59155eb452350acf455d28a3106a7f887
SHA1774031a5bf0c329c796fe905fe6cf49fd77f1bd4
SHA25650b9d89aca736ac2dcbe42ac064ed441b359f6f532057d821b7d614ee10b8374
SHA512357d115b18d40b4300071ee05e1021abf3a8b5dd6bc21f2e0fa6546eff27e02c529780535b4cbebd54cd80a6193ab035d3d8e2217125025b95adb198f77be605
-
memory/1664-132-0x0000000000000000-mapping.dmp
-
memory/1664-136-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1664-137-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1956-135-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB