69b943efb0b8f871b591ce1994bae3e550701a209f79c4d31e2451a69771b166

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

och_antivirus.exe
Size

17.0MB
MD5

41d3613c3bd70904c8ed605bed978987
SHA1

8a44183362dc9dd222cb92b0e0a33b7eb3bc2c34
SHA256

69b943efb0b8f871b591ce1994bae3e550701a209f79c4d31e2451a69771b166
SHA512

bb80f240d675a3c8b0b756f9609bd146faa77bd1c4f23dd0a63825405166908af8aff621e2510e5f67a41e4ea181201ae50a000a3b5bc5ef68dd4806532172b1
SSDEEP

196608:H0bq45mXYPrOLaw1alaHwSiLPpizFNwR3LZBh51ZC1uBaPENjZZ:Ubq4oojOLahLhr9dDZwujL

Score

6^/10

evasion trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

och_antivirus.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA och_antivirus.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	och_antivirus.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

och_antivirus.exe

description	pid	process	target process
PID 2508 wrote to memory of 2820	2508	och_antivirus.exe	WerFault.exe
PID 2508 wrote to memory of 2820	2508	och_antivirus.exe	WerFault.exe
PID 2508 wrote to memory of 2820	2508	och_antivirus.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe
"C:\Users\Admin\AppData\Local\Temp\och_antivirus.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:2508

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2508 -s 356
2⤵
PID:2820

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2508-0-0x0000000100000000-0x0000000101119000-memory.dmp

Filesize
17.1MB

Download