Overview

overview

6

Static

static

1

Oxygen API.dll

windows7-x64

1

Oxygen API.dll

windows10-2004-x64

6

Analysis

  • max time kernel
    131s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-04-2023 18:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Oxygen API.dll

  • Size

    291KB

  • MD5

    e9034685deb48ee57d574239573d7196

  • SHA1

    5a4c0b346a7fe5e2c7624d86426c40819bf8cacb

  • SHA256

    f4c75595e44dcdbbade39a477540f0de2656abf10a02bcbbcd8c05e8bd432bda

  • SHA512

    b9d8b84b1dbd3b597e1e1831516b71c2f0d658e2a69977f4eb2bb3581a7fbd5d9554640a7a2b5fee229a224f265102707cfd708f244ca582b1d62d6c9de8dd00

  • SSDEEP

    6144:kgaRZVLlfh7rZthO+JjkuHEEAt/wz/60baxHU6b:kgoZdfrXg+JwuKt/S/605

Score
6/10

Malware Config

Signatures

  • Drops desktop.ini file(s) 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Oxygen API.dll",#1
    1⤵
      PID:1732
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:3512
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:1236
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
        1⤵
          PID:4840
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultb2de3132h09fbh40cfh93d9hf9d70f406d34
          1⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffc985546f8,0x7ffc98554708,0x7ffc98554718
            2⤵
              PID:3276
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5627065223549237533,15808554367233538070,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
              2⤵
                PID:1668
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,5627065223549237533,15808554367233538070,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:2216
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,5627065223549237533,15808554367233538070,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
                2⤵
                  PID:724
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:4356
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
                  1⤵
                  • Drops desktop.ini file(s)
                  • Checks processor information in registry
                  • Modifies registry class
                  PID:5640
                • C:\Windows\SysWOW64\DllHost.exe
                  C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                  1⤵
                    PID:5752
                  • C:\Windows\SysWOW64\DllHost.exe
                    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                    1⤵
                      PID:5820

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                      Filesize

                      152B

                      MD5

                      5a10efe23009825eadc90c37a38d9401

                      SHA1

                      fd98f2ca011408d4b43ed4dfd5b6906fbc7b87c0

                      SHA256

                      05e135dee0260b4f601a0486401b64ff8653875d74bf259c2da232550dbfb4f5

                      SHA512

                      89416a3f5bf50cd4a432ac72cd0a7fb79d5aeb10bdcc468c55bbfa79b9f43fab17141305d44cb1fe980ec76cc6575c27e2bcfcbad5ccd886d45b9de03fb9d6d7

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                      Filesize

                      70KB

                      MD5

                      e5e3377341056643b0494b6842c0b544

                      SHA1

                      d53fd8e256ec9d5cef8ef5387872e544a2df9108

                      SHA256

                      e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                      SHA512

                      83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Microsoft Edge.lnk
                      Filesize

                      2KB

                      MD5

                      94d5717a345ea83aeeaa25128c8f89e3

                      SHA1

                      30c1757eeb6dcb071d49c7586726e47fa8990e0e

                      SHA256

                      61a699931899b644d3a46ea474def22e7c795466ff4123774ea0f53de3325983

                      SHA512

                      dfc21ce390718b4d9c063582b915d3e57173e930a9a9f2fabb60a25374f702846061dabc113e5e59044b03c2dc181d7c6b22d23741cbab8ee0c38d9bf348f3df

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                      Filesize

                      111B

                      MD5

                      285252a2f6327d41eab203dc2f402c67

                      SHA1

                      acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                      SHA256

                      5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                      SHA512

                      11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                      Filesize

                      3KB

                      MD5

                      70c685708b402063fc9f04cb727f8398

                      SHA1

                      6d0679bd38e56595d54b8192a91e7c48419f8579

                      SHA256

                      96d90772914febb78a87aa3128ccace29a9ff0252cb3403893d43293aa49ebfc

                      SHA512

                      6410df993a2b09e1063c9f5f9eb25f0090f78f0eeb0d1858e25689bc0fd46b50bd3f738f5cfd6bb368f4e0ebdffc99780dd692fdb8a66441b58c0638d213516e

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                      Filesize

                      3KB

                      MD5

                      49b3fe20bf7fe008b5fee0290e385b60

                      SHA1

                      fcaf1a3b59c2cf0c19c4ebee34d467b14dd5be6d

                      SHA256

                      bc434c07692da2bc79f8f045f165656fec4773e9ef6faa62056230570a1c6f0c

                      SHA512

                      0dda481a1fcc570d13001777faeefc4acba45a2afd8258f49d19b6eaa162889caabbd9efc6035f03ef16be55d8aee625091de2444f99766d158c51bc9b1add4b

                      Download Submit

                    • C:\Users\Admin\Videos\Captures\desktop.ini
                      Filesize

                      190B

                      MD5

                      b0d27eaec71f1cd73b015f5ceeb15f9d

                      SHA1

                      62264f8b5c2f5034a1e4143df6e8c787165fbc2f

                      SHA256

                      86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2

                      SHA512

                      7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c

                      Download Submit

                    • memory/5640-224-0x000001DFBFA00000-0x000001DFBFB0A000-memory.dmp

                      Filesize

                      1.0MB

                      Download

                    • memory/5640-225-0x000001DFBFA00000-0x000001DFBFB0A000-memory.dmp

                      Filesize

                      1.0MB

                      Download