Overview

overview

8

Static

static

1

OwlHub.lua

windows7-x64

OwlHub.lua

windows10-2004-x64

3

Analysis

  • max time kernel
    106s
  • max time network
    107s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    06-04-2024 11:43

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    OwlHub.lua

  • Size

    98B

  • MD5

    d6e53fb9faaa2e7ce361a3368abc98bd

  • SHA1

    7ca8ff354c701fadc4d801d4a044c25935b28119

  • SHA256

    4eb89562d4161519e13c075f122bb4ae550303d25e28bcc78c0754b216603551

  • SHA512

    01dadd7bb94f8c61c00e9b37aae009474cdaaf4529f4e26bf5aad88eb863d6bbc1f1ca62d73e920ff5d6c230eceec39e357acbbf78454d5eb3cf0072c7d9e4de

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 11 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\OwlHub.lua
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2320
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\OwlHub.lua
      2⤵
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Windows\eHome\ehshell.exe
        "C:\Windows\eHome\ehshell.exe" "C:\Users\Admin\AppData\Local\Temp\OwlHub.lua"
        3⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2592
  • C:\Program Files (x86)\Microsoft Office\Office14\Groove.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\Groove.exe" /TrayOnly /NoLogon
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
      "C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1324
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:668
      • C:\Windows\SysWOW64\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 1324
        3⤵
          PID:268
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1344
      • C:\Windows\system32\mmc.exe
        "C:\Windows\system32\mmc.exe" C:\Windows\system32\devmgmt.msc
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2172
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:2672
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
        1⤵
          PID:2220
        • C:\Windows\SysWOW64\DllHost.exe
          C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
          1⤵
            PID:2532
          • C:\Windows\system32\LogonUI.exe
            "LogonUI.exe" /flags:0x0
            1⤵
              PID:2812
            • C:\Windows\system32\LogonUI.exe
              "LogonUI.exe" /flags:0x1
              1⤵
                PID:1664

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{E30D464C-5A86-48DC-ACAB-860D98DD168B}.FSD
                Filesize

                128KB

                MD5

                6efcb11248587f064cf8c8ff230b0789

                SHA1

                bc3e497a07aab0384ddfce100bd81812701d84d4

                SHA256

                66f15ddc3b2eab85069f3f5e2e6799cb0ac6c1f0d2e339f536523489829e4b3a

                SHA512

                891a9825110d4cf5d050941eab0e1e80f94ee04ef47332df873df7ebc02ec432f81ef6975fae3884fa23d34442b0a1db0f0369b344ef1a8bc66dcaa1a08780ea

                Download Submit

              • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD
                Filesize

                128KB

                MD5

                98e1b762adc6163947e407a9e605dfed

                SHA1

                6ccd9b418abfa3f588f29d97a33ae199c0ef879d

                SHA256

                b9a73309f5000d258d76370467ab80b416f6ed320ae7eb37235eaf9e793b5fcd

                SHA512

                e3d79d2e8e291c90532af459c2fbf684296a929b811e48a6b0aa88ca23d66734c6fe53b567952307b7fd1f0df2263a6ff863955ea3500403fb9e0fd03663fa81

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\259425045.cvr
                Filesize

                560B

                MD5

                e44c990b36279914cf85ec0ce47f2982

                SHA1

                611dd3535aedeaac9605e27d08c2ddda8bf52118

                SHA256

                f03db467aab74446b8496453cb2b49e73c741ea9781f5529fde40c701fc9c929

                SHA512

                28074307f1d626f918426835c0c425cb5d14820f1db58205adb6b2167a17b3e6d1ed03960697933cff0993239b96b834ccf65fd9840acfcb9d747056051800a2

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\{01EFAA15-3161-4F80-A662-68BC55FB4794}
                Filesize

                128KB

                MD5

                4f2ef323b7166021c319cc4dfa267056

                SHA1

                e50d7f9d8042299be7534063752c528e7a302755

                SHA256

                a0b19985678a3ef168af086b539673726503e6162ef0fe3d9ca042eff48a736f

                SHA512

                2f3ada773ec259396749188db875334c9b2853719d16da59f450537796e39bb7f0b7f5f90de035e2a8c02655249e1148700103a11ae39579183561cf6fb268e7

                Download Submit

              • memory/268-100-0x00000000002C0000-0x00000000002C1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1344-112-0x00000000045A0000-0x00000000045A1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1344-110-0x00000000055D0000-0x00000000055E0000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1344-109-0x00000000045A0000-0x00000000045A1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1664-121-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2172-115-0x0000000002270000-0x0000000002271000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2172-114-0x000007FEF25B0000-0x000007FEF25EA000-memory.dmp

                Filesize

                232KB

                Download

              • memory/2172-113-0x0000000002270000-0x0000000002271000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2192-101-0x000000007333D000-0x0000000073348000-memory.dmp

                Filesize

                44KB

                Download

              • memory/2192-40-0x000000007333D000-0x0000000073348000-memory.dmp

                Filesize

                44KB

                Download

              • memory/2192-39-0x00000000023F0000-0x00000000023F1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2192-37-0x000000005FFF0000-0x0000000060000000-memory.dmp

                Filesize

                64KB

                Download

              • memory/2592-33-0x000000001CD10000-0x000000001CDAE000-memory.dmp

                Filesize

                632KB

                Download

              • memory/2592-107-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

                Filesize

                9.6MB

                Download

              • memory/2592-35-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

                Filesize

                9.6MB

                Download

              • memory/2592-36-0x0000000002020000-0x00000000020A0000-memory.dmp

                Filesize

                512KB

                Download

              • memory/2592-34-0x000000001E9C0000-0x000000001EA78000-memory.dmp

                Filesize

                736KB

                Download

              • memory/2592-24-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

                Filesize

                9.6MB

                Download

              • memory/2592-103-0x000000001EA80000-0x000000001EAB7000-memory.dmp

                Filesize

                220KB

                Download

              • memory/2592-104-0x000000001BB60000-0x000000001BB6A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/2592-105-0x000000001BB60000-0x000000001BB6A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/2592-38-0x0000000002020000-0x00000000020A0000-memory.dmp

                Filesize

                512KB

                Download

              • memory/2592-108-0x0000000002020000-0x00000000020A0000-memory.dmp

                Filesize

                512KB

                Download

              • memory/2592-32-0x000000001B570000-0x000000001B571000-memory.dmp

                Filesize

                4KB

                Download

              • memory/2592-31-0x000000001E6B0000-0x000000001E834000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/2592-30-0x000000001E0A0000-0x000000001E6A8000-memory.dmp

                Filesize

                6.0MB

                Download

              • memory/2592-29-0x0000000002020000-0x00000000020A0000-memory.dmp

                Filesize

                512KB

                Download

              • memory/2592-27-0x0000000002020000-0x00000000020A0000-memory.dmp

                Filesize

                512KB

                Download

              • memory/2592-26-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmp

                Filesize

                9.6MB

                Download

              • memory/2592-25-0x0000000002020000-0x00000000020A0000-memory.dmp

                Filesize

                512KB

                Download

              • memory/2812-120-0x0000000002D90000-0x0000000002D91000-memory.dmp

                Filesize

                4KB

                Download