05a747f54188d9e72c3f582fef65b686885ff7fab849f129e1eadd9526867295

Analysis

max time kernel
146s
max time network
305s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OInstall.exe
Size

30.4MB
MD5

11002d91453bc60e8e581d24a21d0b58
SHA1

33767ec31bc367af24c44c30143f0f4966e1e2b2
SHA256

05a747f54188d9e72c3f582fef65b686885ff7fab849f129e1eadd9526867295
SHA512

0b628e060149b3473f4d9564c3eebbe4af1bd55b634676c9848d8137288f425bc8c856016b9a1cd7d11e8170c6ddcc3c343b33fb1fc2200b8d790a1f8965bbbe
SSDEEP

786432:2vRkdObGXYztqYMa0qGFPt7lgx+SSuiy2Qx7dH//q:gkd4zdMzqGJt7lgLSuiy2Qx7dH//q

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
19	4468	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5000	files.dat

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4468	powershell.exe
4468	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2824	WMIC.exe
Token: SeSecurityPrivilege	2824	WMIC.exe
Token: SeTakeOwnershipPrivilege	2824	WMIC.exe
Token: SeLoadDriverPrivilege	2824	WMIC.exe
Token: SeSystemProfilePrivilege	2824	WMIC.exe
Token: SeSystemtimePrivilege	2824	WMIC.exe
Token: SeProfSingleProcessPrivilege	2824	WMIC.exe
Token: SeIncBasePriorityPrivilege	2824	WMIC.exe
Token: SeCreatePagefilePrivilege	2824	WMIC.exe
Token: SeBackupPrivilege	2824	WMIC.exe
Token: SeRestorePrivilege	2824	WMIC.exe
Token: SeShutdownPrivilege	2824	WMIC.exe
Token: SeDebugPrivilege	2824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2824	WMIC.exe
Token: SeRemoteShutdownPrivilege	2824	WMIC.exe
Token: SeUndockPrivilege	2824	WMIC.exe
Token: SeManageVolumePrivilege	2824	WMIC.exe
Token: 33	2824	WMIC.exe
Token: 34	2824	WMIC.exe
Token: 35	2824	WMIC.exe
Token: 36	2824	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2824	WMIC.exe
Token: SeSecurityPrivilege	2824	WMIC.exe
Token: SeTakeOwnershipPrivilege	2824	WMIC.exe
Token: SeLoadDriverPrivilege	2824	WMIC.exe
Token: SeSystemProfilePrivilege	2824	WMIC.exe
Token: SeSystemtimePrivilege	2824	WMIC.exe
Token: SeProfSingleProcessPrivilege	2824	WMIC.exe
Token: SeIncBasePriorityPrivilege	2824	WMIC.exe
Token: SeCreatePagefilePrivilege	2824	WMIC.exe
Token: SeBackupPrivilege	2824	WMIC.exe
Token: SeRestorePrivilege	2824	WMIC.exe
Token: SeShutdownPrivilege	2824	WMIC.exe
Token: SeDebugPrivilege	2824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2824	WMIC.exe
Token: SeRemoteShutdownPrivilege	2824	WMIC.exe
Token: SeUndockPrivilege	2824	WMIC.exe
Token: SeManageVolumePrivilege	2824	WMIC.exe
Token: 33	2824	WMIC.exe
Token: 34	2824	WMIC.exe
Token: 35	2824	WMIC.exe
Token: 36	2824	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2240	WMIC.exe
Token: SeSecurityPrivilege	2240	WMIC.exe
Token: SeTakeOwnershipPrivilege	2240	WMIC.exe
Token: SeLoadDriverPrivilege	2240	WMIC.exe
Token: SeSystemProfilePrivilege	2240	WMIC.exe
Token: SeSystemtimePrivilege	2240	WMIC.exe
Token: SeProfSingleProcessPrivilege	2240	WMIC.exe
Token: SeIncBasePriorityPrivilege	2240	WMIC.exe
Token: SeCreatePagefilePrivilege	2240	WMIC.exe
Token: SeBackupPrivilege	2240	WMIC.exe
Token: SeRestorePrivilege	2240	WMIC.exe
Token: SeShutdownPrivilege	2240	WMIC.exe
Token: SeDebugPrivilege	2240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2240	WMIC.exe
Token: SeRemoteShutdownPrivilege	2240	WMIC.exe
Token: SeUndockPrivilege	2240	WMIC.exe
Token: SeManageVolumePrivilege	2240	WMIC.exe
Token: 33	2240	WMIC.exe
Token: 34	2240	WMIC.exe
Token: 35	2240	WMIC.exe
Token: 36	2240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2240	WMIC.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 4264	1832	OInstall.exe	89
PID 1832 wrote to memory of 4264	1832	OInstall.exe	89
PID 1832 wrote to memory of 1868	1832	OInstall.exe	91
PID 1832 wrote to memory of 1868	1832	OInstall.exe	91
PID 4264 wrote to memory of 2824	4264	cmd.exe	93
PID 4264 wrote to memory of 2824	4264	cmd.exe	93
PID 1832 wrote to memory of 4580	1832	OInstall.exe	94
PID 1832 wrote to memory of 4580	1832	OInstall.exe	94
PID 4580 wrote to memory of 5000	4580	cmd.exe	97
PID 4580 wrote to memory of 5000	4580	cmd.exe	97
PID 4580 wrote to memory of 5000	4580	cmd.exe	97
PID 1832 wrote to memory of 1584	1832	OInstall.exe	98
PID 1832 wrote to memory of 1584	1832	OInstall.exe	98
PID 1584 wrote to memory of 2240	1584	cmd.exe	100
PID 1584 wrote to memory of 2240	1584	cmd.exe	100
PID 1832 wrote to memory of 4468	1832	OInstall.exe	101
PID 1832 wrote to memory of 4468	1832	OInstall.exe	101
PID 1832 wrote to memory of 4468	1832	OInstall.exe	101

C:\Users\Admin\AppData\Local\Temp\OInstall.exe
"C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\OInstall.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2824
- C:\Windows\system32\reg.exe
  "C:\Windows\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
  2⤵
  PID:1868
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c files.dat -y -pkmsauto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\files\files.dat
    files.dat -y -pkmsauto
    3⤵
    - Executes dropped EXE
    PID:5000
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\files"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -nop -command "& { (New-Object Net.WebClient).DownloadFile('https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v2/C2RReleaseData', 'C:\Users\Admin\AppData\Local\Temp\ver.txt') }"
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1zn4braj.45g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\files\files.dat

Filesize
765KB

MD5
bb5569b15d68c10b7ff2d96b45825120

SHA1
d6d2ed450aae4552f550f59bffe3dd42d8377835

SHA256
4e3b13b56bec0e41778e6506430282bbbd75ccaa600fd4b645ce37dd95b44c8e

SHA512
640a9ae2d40c272638485d37fad4ed83c9c215ce60a0bd3d50db9f033aa79d4c7fc276d018b05f0b1d8446f5e84a7350c857ee8097c05a472c26bfb446038957

Download Submit
C:\Users\Admin\AppData\Local\Temp\ver.txt

Filesize
55KB

MD5
83013b9c842c110ffcc3259605d36e29

SHA1
4af8ccf2260bd6a7cd27a4489b034bc33a80d09c

SHA256
40f8ee2db6c77b62d285ff3b8f5d83c219542b25c066b1b3f4181eb2996645b5

SHA512
74f13a3ec2fc2231cf4d756853d849eb9d515cfec9e2b4376777266fe496a5c17c47365e83159f70a7d64aa286f58e6e8cc6c205e147b074d451c45acf438ce8

Download Submit
memory/4468-33-0x0000000004E30000-0x0000000005458000-memory.dmp

Filesize
6.2MB

Download
memory/4468-47-0x0000000005D00000-0x0000000005D1E000-memory.dmp

Filesize
120KB

Download
memory/4468-34-0x0000000004D70000-0x0000000004D92000-memory.dmp

Filesize
136KB

Download
memory/4468-35-0x0000000005650000-0x00000000056B6000-memory.dmp

Filesize
408KB

Download
memory/4468-36-0x00000000056C0000-0x0000000005726000-memory.dmp

Filesize
408KB

Download
memory/4468-31-0x00000000735D0000-0x0000000073D80000-memory.dmp

Filesize
7.7MB

Download
memory/4468-46-0x0000000005730000-0x0000000005A84000-memory.dmp

Filesize
3.3MB

Download
memory/4468-32-0x00000000047F0000-0x0000000004800000-memory.dmp

Filesize
64KB

Download
memory/4468-48-0x0000000005D40000-0x0000000005D8C000-memory.dmp

Filesize
304KB

Download
memory/4468-49-0x00000000047F0000-0x0000000004800000-memory.dmp

Filesize
64KB

Download
memory/4468-50-0x0000000007550000-0x0000000007BCA000-memory.dmp

Filesize
6.5MB

Download
memory/4468-51-0x0000000006240000-0x000000000625A000-memory.dmp

Filesize
104KB

Download
memory/4468-55-0x00000000735D0000-0x0000000073D80000-memory.dmp

Filesize
7.7MB

Download
memory/4468-30-0x0000000004760000-0x0000000004796000-memory.dmp

Filesize
216KB

Download