Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe
-
Size
67KB
-
MD5
9d08c385a3cc6c791d7bca3985a8c2d3
-
SHA1
cd42df1893bcb116b761735982bb6ca4a582a71b
-
SHA256
7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8
-
SHA512
462586f7154b07d8dca4d8fc6bdd8e6b1fc2766ea45d0f3f61829bbd3bc35452676898c2453ee6f9ed804bc4761634524be8b124cfebba73511cfc1ee3c87acd
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+dwK:ulg35GTslA5t3GdwK
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ovvoboac-oceas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ovvoboac-oceas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ovvoboac-oceas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ovvoboac-oceas.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46} ovvoboac-oceas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ovvoboac-oceas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\IsInstalled = "1" ovvoboac-oceas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\StubPath = "C:\\Windows\\system32\\bsurah-usom.exe" ovvoboac-oceas.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ovvoboac-oceas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ovvoboac-oceas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\espatit.exe" ovvoboac-oceas.exe -
Executes dropped EXE 2 IoCs
pid Process 2052 ovvoboac-oceas.exe 2456 ovvoboac-oceas.exe -
Loads dropped DLL 3 IoCs
pid Process 2032 7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe 2032 7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe 2052 ovvoboac-oceas.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ovvoboac-oceas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ovvoboac-oceas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ovvoboac-oceas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ovvoboac-oceas.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ovvoboac-oceas.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ovvoboac-oceas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ovvoboac-oceas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ibdohoad-icom.dll" ovvoboac-oceas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ovvoboac-oceas.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ovvoboac-oceas.exe 7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe File opened for modification C:\Windows\SysWOW64\espatit.exe ovvoboac-oceas.exe File opened for modification C:\Windows\SysWOW64\ibdohoad-icom.dll ovvoboac-oceas.exe File created C:\Windows\SysWOW64\bsurah-usom.exe ovvoboac-oceas.exe File created C:\Windows\SysWOW64\ibdohoad-icom.dll ovvoboac-oceas.exe File opened for modification C:\Windows\SysWOW64\ovvoboac-oceas.exe ovvoboac-oceas.exe File created C:\Windows\SysWOW64\ovvoboac-oceas.exe 7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe File created C:\Windows\SysWOW64\espatit.exe ovvoboac-oceas.exe File opened for modification C:\Windows\SysWOW64\bsurah-usom.exe ovvoboac-oceas.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2456 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe 2052 ovvoboac-oceas.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2032 7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe Token: SeDebugPrivilege 2052 ovvoboac-oceas.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2052 2032 7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe 28 PID 2032 wrote to memory of 2052 2032 7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe 28 PID 2032 wrote to memory of 2052 2032 7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe 28 PID 2032 wrote to memory of 2052 2032 7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe 28 PID 2052 wrote to memory of 2456 2052 ovvoboac-oceas.exe 29 PID 2052 wrote to memory of 2456 2052 ovvoboac-oceas.exe 29 PID 2052 wrote to memory of 2456 2052 ovvoboac-oceas.exe 29 PID 2052 wrote to memory of 2456 2052 ovvoboac-oceas.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe"C:\Users\Admin\AppData\Local\Temp\7bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\SysWOW64\ovvoboac-oceas.exe"C:\Windows\system32\ovvoboac-oceas.exe"2⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\ovvoboac-oceas.exeùù¿çç¤3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2456
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD552bb1d3d592c13b8070907ac906febf7
SHA17bec1310a4529e54a14d37ac067faa0e17d82621
SHA256956b37ff75a6dced4e56955acb8b1acb5da6d9cb39da54389288f6e518a1cb10
SHA5120e8c3b7e216ff3c451ef99e423a93e1d38ed10868e1d8b98a43c1854106be8912a435a2b74b7add8292d115ff31e97fa0126fc4622de3ca5891e3b2bdca97628
-
Filesize
70KB
MD5c089d84cace932fa16ddfa40ba35d7dd
SHA1551cf85f1299659c7bb3407a2fcbce57acff58ca
SHA25675f5614233f895d6707315d1d0793325c674cdbe7b9626a42ab085215ef87889
SHA5123efebbd82d0ad647b23bbe9f0536bc667375bb5bf20aab1fea69ef660cd3a3157b90667ae0a7044cadf24c153e44a0dcf2abe033d64f399a10c422fe1dc35acb
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
67KB
MD59d08c385a3cc6c791d7bca3985a8c2d3
SHA1cd42df1893bcb116b761735982bb6ca4a582a71b
SHA2567bf29538aec9a8d46436c939b37b539b8c9dccdbe7d29fd8b12bdd0e97ac25a8
SHA512462586f7154b07d8dca4d8fc6bdd8e6b1fc2766ea45d0f3f61829bbd3bc35452676898c2453ee6f9ed804bc4761634524be8b124cfebba73511cfc1ee3c87acd