Analysis
-
max time kernel
100s -
max time network
97s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 14:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
owo.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
owo.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
owo.exe
-
Size
1.1MB
-
MD5
a8dc95a47e63c8a63b364e04230fab5f
-
SHA1
bd29a3ea75cf4f106854fe9f71a5f7c4181ea6fe
-
SHA256
ca6f4034d413ad23c9515c79fb954ac2a1b33334510123e2a400bfc8aad52210
-
SHA512
1db5e2ba83e3ef0e1ad9418fcc5aca8dbe3ebd69bc0106afc618e6ff7a2ea4e8495a498516bf5acdae784e3d533e8b47b24fc59f709021d30fb426c713044237
-
SSDEEP
24576:jf4RpknVIEM+TynERzhwExMEswIYzbwg38U3c:j4RpknVISyEoEswpzbwtp
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2220 owo.exe 3052 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3052 taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 2220 owo.exe 2220 owo.exe 2020 owo.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 2220 owo.exe 2220 owo.exe 2020 owo.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2220 owo.exe 2220 owo.exe 2220 owo.exe 2220 owo.exe 2220 owo.exe 2220 owo.exe 2020 owo.exe 2020 owo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\owo.exe"C:\Users\Admin\AppData\Local\Temp\owo.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2220
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\owo.exe"C:\Users\Admin\AppData\Local\Temp\owo.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2020
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3052