3da6828f8567c3cfbd3982484da2f94dd40f721a77fd46c624268cdb550c0035

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
oofile_1.47/oofile.exe
Size 256KB
Sample240415-mkveesef6w
SHA256 530075b0aa1716c3782b26ebaeb5d45735c6e7e97931a44a798510a5c47e0221
MD5 c914296daf71a04ef114271500d8315b
SHA1 5046cddbd10683d478b70721ee472cc9ee70066a
SHA512 7f9cf37deb570eb839c2d81a32828762e4884f6dd2d783582e82ef62dda9688ead765918fdae725a5b63dc1c0dc0072b37b4ed393a451248ecf1231aeaf6e3d5
SSDEEP 3072:cRCTg1Y3ZaYhuXAmgRp9ZFd5d2YGdpxHdXSKJLUQNLdZXARuLlnrzlLiVl:oqZ5ufcFFd5d2FIU5WuZnli
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

bootkit persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\oofile = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oofile_1.47\\oofile.exe -h"	oofile.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	oofile.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main	oofile.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	oofile.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	oofile.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E66F9030-D86D-471D-A68B-4743E94FD681}\TypeLib\ = "{AF0F0C25-BA24-47BA-AEC7-4968A4112D1C}"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{058159F8-6BC7-4C6C-B620-2AD93A4DDB86}\TypeLib	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F2960687-EC5E-4584-BEF9-EFC7D1D86112}\TypeLib	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\w_exployer.HostInfo.1\ = "HostInfo Class"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{07D1FA7A-925A-478C-B771-321852587289}\TypeLib\Version = "1.0"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07D1FA7A-925A-478C-B771-321852587289}\TypeLib\ = "{AF0F0C25-BA24-47BA-AEC7-4968A4112D1C}"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF0F0C25-BA24-47BA-AEC7-4968A4112D1C}	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileTranDll.Client.1	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ECA96510-AEDA-4E7E-BFE2-06A257E2EBF3}\ProgID	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ECA96510-AEDA-4E7E-BFE2-06A257E2EBF3}\ProgID\ = "FileTranDll.Client.1"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{058159F8-6BC7-4C6C-B620-2AD93A4DDB86}\ = "Connection Class"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\w_exployer.HostInfo.1\CLSID	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60F52C71-FAB3-42A9-AA7D-5B6D0323E494}	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DC442BB-F3F5-4D6D-ACDC-2B8A312F1F64}\VersionIndependentProgID	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FileTranDll.Client\ = "Client Class"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileTranDll.Connection\CurVer	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{058159F8-6BC7-4C6C-B620-2AD93A4DDB86}\Programmable	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F2960687-EC5E-4584-BEF9-EFC7D1D86112}\ProxyStubClsid32	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{39D227FE-B8D8-493D-B15C-A28DA094FDA2}\ = "IConnection"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileTranDll.Server.1	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F2960687-EC5E-4584-BEF9-EFC7D1D86112}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileTranDll.Client.1\CLSID	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F2960687-EC5E-4584-BEF9-EFC7D1D86112}\TypeLib\ = "{80AECCA8-6A06-4BDF-8803-624E7CE96F56}"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF0F0C25-BA24-47BA-AEC7-4968A4112D1C}\1.0\HELPDIR\	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DA4341B7-2043-4BA6-B8D2-CC3FDFA0C537}\ = "Server Class"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileTranDll.Connection\CLSID	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FileTranDll.Client.1\CLSID\ = "{ECA96510-AEDA-4E7E-BFE2-06A257E2EBF3}"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BB67838-EEC5-4798-9716-848954DF9AA2}\VersionIndependentProgID\ = "w_exployer.RcSend"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ECA96510-AEDA-4E7E-BFE2-06A257E2EBF3}\TypeLib	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F2960687-EC5E-4584-BEF9-EFC7D1D86112}\TypeLib\Version = "1.0"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BB67838-EEC5-4798-9716-848954DF9AA2}	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DC442BB-F3F5-4D6D-ACDC-2B8A312F1F64}\InprocServer32\ThreadingModel = "Both"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07D1FA7A-925A-478C-B771-321852587289}\ProxyStubClsid32	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\w_exployer.HostInfo\CurVer	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C09B0011-6B92-4FFB-BCC3-5AE3716B09CB}\Programmable	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{07D1FA7A-925A-478C-B771-321852587289}\TypeLib	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{60F52C71-FAB3-42A9-AA7D-5B6D0323E494}\ProxyStubClsid32	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F2960687-EC5E-4584-BEF9-EFC7D1D86112}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BB67838-EEC5-4798-9716-848954DF9AA2}\InprocServer32	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BB67838-EEC5-4798-9716-848954DF9AA2}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oofile_1.47\\w_exployer.dll"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BB67838-EEC5-4798-9716-848954DF9AA2}\TypeLib\ = "{AF0F0C25-BA24-47BA-AEC7-4968A4112D1C}"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E66F9030-D86D-471D-A68B-4743E94FD681}\TypeLib\Version = "1.0"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{058159F8-6BC7-4C6C-B620-2AD93A4DDB86}\ProgID\ = "FileTranDll.Connection.1"	oofile.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BB67838-EEC5-4798-9716-848954DF9AA2}\Programmable	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF0F0C25-BA24-47BA-AEC7-4968A4112D1C}\1.0\ = "Filemax 1.0 Right Click"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ECA96510-AEDA-4E7E-BFE2-06A257E2EBF3}\InprocServer32\ThreadingModel = "Apartment"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\w_exployer.RcSend.1	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\w_exployer.RcSend\ = "RcSend Class"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileTranDll.Client	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FileTranDll.Client\CLSID	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ECA96510-AEDA-4E7E-BFE2-06A257E2EBF3}\TypeLib\ = "{80AECCA8-6A06-4BDF-8803-624E7CE96F56}"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ECA96510-AEDA-4E7E-BFE2-06A257E2EBF3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oofile_1.47\\FileTranDll.dll"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80AECCA8-6A06-4BDF-8803-624E7CE96F56}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oofile_1.47\\FileTranDll.dll"	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{60F52C71-FAB3-42A9-AA7D-5B6D0323E494}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60F52C71-FAB3-42A9-AA7D-5B6D0323E494}\ProxyStubClsid32	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E66F9030-D86D-471D-A68B-4743E94FD681}	oofile.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DA4341B7-2043-4BA6-B8D2-CC3FDFA0C537}\TypeLib\ = "{80AECCA8-6A06-4BDF-8803-624E7CE96F56}"	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{39D227FE-B8D8-493D-B15C-A28DA094FDA2}\ProxyStubClsid32	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9BB67838-EEC5-4798-9716-848954DF9AA2}\TypeLib	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{80AECCA8-6A06-4BDF-8803-624E7CE96F56}\1.0\HELPDIR	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60F52C71-FAB3-42A9-AA7D-5B6D0323E494}\TypeLib	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39D227FE-B8D8-493D-B15C-A28DA094FDA2}\ProxyStubClsid32	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\w_exployer.RcSend	oofile.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\w_exployer.YSysTray\CurVer	oofile.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1948	oofile.exe
1948	oofile.exe
1948	oofile.exe
1948	oofile.exe
1948	oofile.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
1948	oofile.exe
1948	oofile.exe
1948	oofile.exe
1948	oofile.exe
1948	oofile.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1948	oofile.exe
1948	oofile.exe

C:\Users\Admin\AppData\Local\Temp\oofile_1.47\oofile.exe
"C:\Users\Admin\AppData\Local\Temp\oofile_1.47\oofile.exe"
1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

config.ini

Path C:\Users\Admin\AppData\Local\Temp\oofile_1.47\data\config.ini
Size 370B
SHA256 f6fb283e4dcedd30579edf37cb241498186d79131e37a1919f0dcd3216c1bcb2
MD5 0f5712d99f428e49ede8f5278be4f1d0
SHA1 7b9bae009c897a5a6e8f0c16b038b5c2b0cf8b14
SHA512 2793f5cf7512ed690f7d5456b40e5bbe727c0c23590b6e05ac00df9991980e62e29d71073b9398578fb310e7f276ae4ceec6a2688f26997895c5f7c6bab7df01
MD5 SHA1 SHA512

Submit Download

memory/1948-0-0x0000000000270000-0x0000000000271000-memory.dmp

Download

memory/1948-1-0x0000000001F90000-0x0000000001FE5000-memory.dmp

Download

memory/1948-172-0x0000000000270000-0x0000000000271000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads