Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe
-
Size
70KB
-
MD5
6968ce5705f8f89230a3fd10d2eff542
-
SHA1
630ca7810ffeff50861f81728cb9606d66a63587
-
SHA256
e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77
-
SHA512
449403ba67c7cdef6a995ed122969463357d9bdca69387ffdefc1d7e4cb01521790d6290b68bb01fd4ce9ec5acbe88f25669ca2cf2278397767caf39b612fbd4
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8r:Olg35GTslA5t3/w8r
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ouclasan-afur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ouclasan-afur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ouclasan-afur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ouclasan-afur.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E515054-544d-524d-4E51-5054544D524d} ouclasan-afur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E515054-544d-524d-4E51-5054544D524d}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" ouclasan-afur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E515054-544d-524d-4E51-5054544D524d}\IsInstalled = "1" ouclasan-afur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4E515054-544d-524d-4E51-5054544D524d}\StubPath = "C:\\Windows\\system32\\ilsenoag.exe" ouclasan-afur.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe ouclasan-afur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" ouclasan-afur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\omlubeb.exe" ouclasan-afur.exe -
Executes dropped EXE 2 IoCs
pid Process 2132 ouclasan-afur.exe 3068 ouclasan-afur.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" ouclasan-afur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" ouclasan-afur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" ouclasan-afur.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" ouclasan-afur.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\eamxeabod.dll" ouclasan-afur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" ouclasan-afur.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} ouclasan-afur.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify ouclasan-afur.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" ouclasan-afur.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\ilsenoag.exe ouclasan-afur.exe File opened for modification C:\Windows\SysWOW64\eamxeabod.dll ouclasan-afur.exe File created C:\Windows\SysWOW64\eamxeabod.dll ouclasan-afur.exe File opened for modification C:\Windows\SysWOW64\ouclasan-afur.exe ouclasan-afur.exe File opened for modification C:\Windows\SysWOW64\ouclasan-afur.exe e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe File created C:\Windows\SysWOW64\ouclasan-afur.exe e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe File opened for modification C:\Windows\SysWOW64\ilsenoag.exe ouclasan-afur.exe File opened for modification C:\Windows\SysWOW64\omlubeb.exe ouclasan-afur.exe File created C:\Windows\SysWOW64\omlubeb.exe ouclasan-afur.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 3068 ouclasan-afur.exe 3068 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe 2132 ouclasan-afur.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2300 e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe Token: SeDebugPrivilege 2132 ouclasan-afur.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 2132 2300 e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe 82 PID 2300 wrote to memory of 2132 2300 e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe 82 PID 2300 wrote to memory of 2132 2300 e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe 82 PID 2132 wrote to memory of 604 2132 ouclasan-afur.exe 5 PID 2132 wrote to memory of 3068 2132 ouclasan-afur.exe 83 PID 2132 wrote to memory of 3068 2132 ouclasan-afur.exe 83 PID 2132 wrote to memory of 3068 2132 ouclasan-afur.exe 83 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56 PID 2132 wrote to memory of 3472 2132 ouclasan-afur.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:604
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe"C:\Users\Admin\AppData\Local\Temp\e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\SysWOW64\ouclasan-afur.exe"C:\Windows\system32\ouclasan-afur.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\ouclasan-afur.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3068
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
72KB
MD593bcceb06f72ce0ded913892f8e31d6b
SHA1d3012c149d0288d7e70acbb1c899aeba405639b7
SHA2566e2e27ce05df6d5b21df7781631ebcf4d1ba9ef1cf524706cbb7a50b55de6d1f
SHA512fe4e9abe15607dc04fb2461fbb0a4d088a50f3e24977afebbb55591fcee7e624d28d336ed4711af06a91a034df08cca566318dcc8de7382b2d3f2960077a535b
-
Filesize
73KB
MD5a728e37389adbc2637ac93ecafec3b83
SHA1dd32e24e3a90b712c9432429cef466aa8d1d073d
SHA256598eb9a5d3d9a71b21b85ca676345741b5cd3d233cc41b031b7863a382d29991
SHA5124342672831249e16bd2006e7ef9b1714e1364f64fcefbf453917f4fee3c8164465bf76eddb9fbc1c4810ddf54a8b8ca34001fe5528e03add9e0571ee5cbff693
-
Filesize
70KB
MD56968ce5705f8f89230a3fd10d2eff542
SHA1630ca7810ffeff50861f81728cb9606d66a63587
SHA256e18e6e622ba617e551df2dd4975bb3f67da0d728050ca99d37e46af5468f9c77
SHA512449403ba67c7cdef6a995ed122969463357d9bdca69387ffdefc1d7e4cb01521790d6290b68bb01fd4ce9ec5acbe88f25669ca2cf2278397767caf39b612fbd4