Analysis
-
max time kernel
149s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 22:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe
-
Size
70KB
-
MD5
005cca6b5a04b0d9b7f84ba8a5a9e268
-
SHA1
e3b70191fac4a472c7b5894687cc6b8062a67b92
-
SHA256
5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2
-
SHA512
f239b769eb5834684f48790aeb7130223477a47d27832b6e177de642076181b15a0e3b393cb9a22a1639ff62ba54fad149c9a34b0678ff8bf61190167fa8364d
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8U:Olg35GTslA5t3/w8U
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" dvakoof-osum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" dvakoof-osum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" dvakoof-osum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" dvakoof-osum.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\StubPath = "C:\\Windows\\system32\\agloorood-eacoot.exe" dvakoof-osum.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945} dvakoof-osum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" dvakoof-osum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\IsInstalled = "1" dvakoof-osum.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe dvakoof-osum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" dvakoof-osum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\xditev.exe" dvakoof-osum.exe -
Executes dropped EXE 2 IoCs
pid Process 1940 dvakoof-osum.exe 1132 dvakoof-osum.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" dvakoof-osum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" dvakoof-osum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" dvakoof-osum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" dvakoof-osum.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} dvakoof-osum.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify dvakoof-osum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" dvakoof-osum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\ohbicer.dll" dvakoof-osum.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" dvakoof-osum.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\dvakoof-osum.exe 5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe File opened for modification C:\Windows\SysWOW64\xditev.exe dvakoof-osum.exe File opened for modification C:\Windows\SysWOW64\agloorood-eacoot.exe dvakoof-osum.exe File created C:\Windows\SysWOW64\agloorood-eacoot.exe dvakoof-osum.exe File opened for modification C:\Windows\SysWOW64\ohbicer.dll dvakoof-osum.exe File opened for modification C:\Windows\SysWOW64\dvakoof-osum.exe dvakoof-osum.exe File opened for modification C:\Windows\SysWOW64\dvakoof-osum.exe 5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe File created C:\Windows\SysWOW64\ohbicer.dll dvakoof-osum.exe File created C:\Windows\SysWOW64\xditev.exe dvakoof-osum.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1132 dvakoof-osum.exe 1132 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe 1940 dvakoof-osum.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4260 5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe Token: SeDebugPrivilege 1940 dvakoof-osum.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 1940 4260 5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe 83 PID 4260 wrote to memory of 1940 4260 5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe 83 PID 4260 wrote to memory of 1940 4260 5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe 83 PID 1940 wrote to memory of 608 1940 dvakoof-osum.exe 5 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 1132 1940 dvakoof-osum.exe 84 PID 1940 wrote to memory of 1132 1940 dvakoof-osum.exe 84 PID 1940 wrote to memory of 1132 1940 dvakoof-osum.exe 84 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56 PID 1940 wrote to memory of 3404 1940 dvakoof-osum.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:608
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe"C:\Users\Admin\AppData\Local\Temp\5c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2.exe"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\dvakoof-osum.exe"C:\Windows\system32\dvakoof-osum.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\SysWOW64\dvakoof-osum.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1132
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD53df1704896a248ee034a0f61508b0d05
SHA126271234c67d79a287786bec89c2d828c459f24a
SHA256fef661fc84552c1269bf04ad7bbb036430122738d53e43c933ab2c7080267181
SHA51242939c283b556aa2268f8c9040e00eb9fce44b30d007330bb788a27d4a844d97c80392dfe27349922db52512700c40dd6872d91a50ef78f048952ea63f3c357e
-
Filesize
70KB
MD5005cca6b5a04b0d9b7f84ba8a5a9e268
SHA1e3b70191fac4a472c7b5894687cc6b8062a67b92
SHA2565c6c68ba99d924b122072afc4a871cd513803e19701dfd14394791030fdde9e2
SHA512f239b769eb5834684f48790aeb7130223477a47d27832b6e177de642076181b15a0e3b393cb9a22a1639ff62ba54fad149c9a34b0678ff8bf61190167fa8364d
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
74KB
MD581c400e01c205d864ad152825ec4ede6
SHA137b7285a8fa96a5f9af2da28ae450279077d3867
SHA256370dae522c1843b479c5c364154524b2e3e966fa0a29e7829331b78755d679ee
SHA512f12b5d95cf3f00d16f44720a9a3478a3e9a36047b307c8cb36357b2a0845344ecbf90b7107f4a0ac774e32f7a064a678adfd05026949ee6c05580c53196067a4