a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c

General

Target

a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c.exe
Size

307KB
MD5

e38f1b280e2c5d3ae57675416c5955b6
SHA1

34d1362bf4590d20b23f9b9dc62447d5f5f0d54e
SHA256

a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c
SHA512

a054960d4553e611f1a2a85b6cced45052edd8d9eb276d44f658948f988ee07eaaef3375828b97843a917f945e084981aff3cae974356293f0bc50895fa837a6
SSDEEP

6144:wFYmBmFpPjbmnZOMF48Q1PhZWDIqnyIdvHniJQVhq6R0k:wFYmBmFRfWZNlQ1P3WDIgdvHQwBRP

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1324	oupitwsn.exe

Deletes itself 1 IoCs

pid	Process
1520	cmd.exe

Loads dropped DLL 3 IoCs

pid	Process
1520	cmd.exe
1520	cmd.exe
1324	oupitwsn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
668	taskkill.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
856	PING.EXE

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	668	taskkill.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe
1324	oupitwsn.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1520	1752	a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c.exe	27
PID 1752 wrote to memory of 1520	1752	a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c.exe	27
PID 1752 wrote to memory of 1520	1752	a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c.exe	27
PID 1752 wrote to memory of 1520	1752	a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c.exe	27
PID 1520 wrote to memory of 668	1520	cmd.exe	29
PID 1520 wrote to memory of 668	1520	cmd.exe	29
PID 1520 wrote to memory of 668	1520	cmd.exe	29
PID 1520 wrote to memory of 668	1520	cmd.exe	29
PID 1520 wrote to memory of 856	1520	cmd.exe	31
PID 1520 wrote to memory of 856	1520	cmd.exe	31
PID 1520 wrote to memory of 856	1520	cmd.exe	31
PID 1520 wrote to memory of 856	1520	cmd.exe	31
PID 1520 wrote to memory of 1324	1520	cmd.exe	32
PID 1520 wrote to memory of 1324	1520	cmd.exe	32
PID 1520 wrote to memory of 1324	1520	cmd.exe	32
PID 1520 wrote to memory of 1324	1520	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c.exe
"C:\Users\Admin\AppData\Local\Temp\a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /pid 1752 & ping -n 3 127.1 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c.exe" & start C:\Users\Admin\AppData\Local\oupitwsn.exe -f
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /pid 1752
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:668
- - C:\Windows\SysWOW64\PING.EXE
    ping -n 3 127.1
    3⤵
    - Runs ping.exe
    PID:856
- - C:\Users\Admin\AppData\Local\oupitwsn.exe
    C:\Users\Admin\AppData\Local\oupitwsn.exe -f
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\oupitwsn.exe

Filesize
307KB

MD5
e38f1b280e2c5d3ae57675416c5955b6

SHA1
34d1362bf4590d20b23f9b9dc62447d5f5f0d54e

SHA256
a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c

SHA512
a054960d4553e611f1a2a85b6cced45052edd8d9eb276d44f658948f988ee07eaaef3375828b97843a917f945e084981aff3cae974356293f0bc50895fa837a6

Download Submit
C:\Users\Admin\AppData\Local\oupitwsn.exe

Filesize
307KB

MD5
e38f1b280e2c5d3ae57675416c5955b6

SHA1
34d1362bf4590d20b23f9b9dc62447d5f5f0d54e

SHA256
a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c

SHA512
a054960d4553e611f1a2a85b6cced45052edd8d9eb276d44f658948f988ee07eaaef3375828b97843a917f945e084981aff3cae974356293f0bc50895fa837a6

Download Submit
\Users\Admin\AppData\Local\oupitwsn.exe

Filesize
307KB

MD5
e38f1b280e2c5d3ae57675416c5955b6

SHA1
34d1362bf4590d20b23f9b9dc62447d5f5f0d54e

SHA256
a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c

SHA512
a054960d4553e611f1a2a85b6cced45052edd8d9eb276d44f658948f988ee07eaaef3375828b97843a917f945e084981aff3cae974356293f0bc50895fa837a6

Download Submit
\Users\Admin\AppData\Local\oupitwsn.exe

Filesize
307KB

MD5
e38f1b280e2c5d3ae57675416c5955b6

SHA1
34d1362bf4590d20b23f9b9dc62447d5f5f0d54e

SHA256
a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c

SHA512
a054960d4553e611f1a2a85b6cced45052edd8d9eb276d44f658948f988ee07eaaef3375828b97843a917f945e084981aff3cae974356293f0bc50895fa837a6

Download Submit
\Users\Admin\AppData\Local\oupitwsn.exe

Filesize
307KB

MD5
e38f1b280e2c5d3ae57675416c5955b6

SHA1
34d1362bf4590d20b23f9b9dc62447d5f5f0d54e

SHA256
a38023661db0f124ecd7175569381169bef610b1c7c78999607ef75bacd0573c

SHA512
a054960d4553e611f1a2a85b6cced45052edd8d9eb276d44f658948f988ee07eaaef3375828b97843a917f945e084981aff3cae974356293f0bc50895fa837a6

Download Submit
memory/668-58-0x0000000000000000-mapping.dmp

Download
memory/856-59-0x0000000000000000-mapping.dmp

Download
memory/1324-63-0x0000000000000000-mapping.dmp

Download
memory/1324-68-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/1324-69-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/1520-56-0x0000000000000000-mapping.dmp

Download
memory/1752-57-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download
memory/1752-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download
memory/1752-55-0x0000000001000000-0x00000000010A6000-memory.dmp

Filesize
664KB

Download

Analysis

Sharing