Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-05-2024 18:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe
Resource
win7-20240419-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe
-
Size
70KB
-
MD5
43b7353800361fb1c1844b5c3fff19fa
-
SHA1
6544e0d24de882856f0af7fcef2025daa1abaef8
-
SHA256
0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27
-
SHA512
7a416cb5eeb1aac00cf2bad87c679dc6d7d028da028179bb458112462602579cfc46a77d44c92cfbdcf6f4220ef18dfeb2f9778751d9dca81879aac4d48ad883
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8a:Olg35GTslA5t3/w8a
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" oucfeamet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" oucfeamet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" oucfeamet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" oucfeamet.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658} oucfeamet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" oucfeamet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\IsInstalled = "1" oucfeamet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{52494A54-4f4f-5658-5249-4A544F4F5658}\StubPath = "C:\\Windows\\system32\\urxoorac.exe" oucfeamet.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe oucfeamet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" oucfeamet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\eapgoovot-ced.exe" oucfeamet.exe -
Executes dropped EXE 2 IoCs
pid Process 2456 oucfeamet.exe 2016 oucfeamet.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" oucfeamet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" oucfeamet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" oucfeamet.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" oucfeamet.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" oucfeamet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\enniboaf-dex.dll" oucfeamet.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" oucfeamet.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} oucfeamet.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify oucfeamet.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\oucfeamet.exe 0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe File created C:\Windows\SysWOW64\eapgoovot-ced.exe oucfeamet.exe File opened for modification C:\Windows\SysWOW64\urxoorac.exe oucfeamet.exe File opened for modification C:\Windows\SysWOW64\oucfeamet.exe oucfeamet.exe File created C:\Windows\SysWOW64\oucfeamet.exe 0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe File opened for modification C:\Windows\SysWOW64\eapgoovot-ced.exe oucfeamet.exe File created C:\Windows\SysWOW64\urxoorac.exe oucfeamet.exe File opened for modification C:\Windows\SysWOW64\enniboaf-dex.dll oucfeamet.exe File created C:\Windows\SysWOW64\enniboaf-dex.dll oucfeamet.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2016 oucfeamet.exe 2016 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe 2456 oucfeamet.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2664 0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe Token: SeDebugPrivilege 2456 oucfeamet.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2456 2664 0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe 82 PID 2664 wrote to memory of 2456 2664 0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe 82 PID 2664 wrote to memory of 2456 2664 0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe 82 PID 2456 wrote to memory of 620 2456 oucfeamet.exe 5 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 2016 2456 oucfeamet.exe 83 PID 2456 wrote to memory of 2016 2456 oucfeamet.exe 83 PID 2456 wrote to memory of 2016 2456 oucfeamet.exe 83 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56 PID 2456 wrote to memory of 3556 2456 oucfeamet.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe"C:\Users\Admin\AppData\Local\Temp\0f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\oucfeamet.exe"C:\Windows\system32\oucfeamet.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\SysWOW64\oucfeamet.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2016
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD5c8681b283fa217d39ce5ada3757344b7
SHA158df9ae84a8d4a39083a963579c1ab3539ae06b1
SHA256409d3b2258215044cad7a834ace6a0b0a5156de787bdaf2a320727f1591635cf
SHA5128a36a1fb0074086f06298c080c9e66bbe2dba09e587572638afd301b8652b16a12b60f4ae8b973f6531f0013ecfdc3c1c26d1325c6c92b72fdfc75e752d84486
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
70KB
MD543b7353800361fb1c1844b5c3fff19fa
SHA16544e0d24de882856f0af7fcef2025daa1abaef8
SHA2560f5860231770bf2d764c27bef180c84ddd9f3e13b6b8245b87994b4fbbaa6c27
SHA5127a416cb5eeb1aac00cf2bad87c679dc6d7d028da028179bb458112462602579cfc46a77d44c92cfbdcf6f4220ef18dfeb2f9778751d9dca81879aac4d48ad883
-
Filesize
72KB
MD53d7b7e28bfcace0e1cf25289f35669e9
SHA19dd3b83aa2dcd3fb68e14538d645d9e3981acb15
SHA256fe26898604502844a66bd23c53879f2a50aa4b1a58efe9a58a7a0963f90b3918
SHA51297fb021e9d7cd0d9d13752b35e2456ff40c24c93bafdd10262179d2c81a13368d9314084d31c738397fd5f7ae681ad64257489ece9dc595480d65d20680b9bf8