Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
02/06/2024, 01:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f.exe
Resource
win7-20240508-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f.exe
- Size 73KB
- Sample240602-cbbkvafe36
- SHA256 bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f
- MD5 9b55f8c749f23390c40abc9a4ae4eb77
- SHA1 201899492450e5b5c93e6a0242dbec96d351f83e
- SHA512 bd68126bb9b54ed1c914b4129c9a407d852c390ff02f4a44c0cdea55fd596d54e8697633465417117d7b851b57caa5887b009aeb33464a495725ca385f5af890
- SSDEEP 1536:xUjqejfG/FOxahwjcADmkOMWtCf4Riwdw46Xi:ajh4FWahwj/OlthQ42i
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" orlisoos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" orlisoos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" orlisoos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" orlisoos.exe - Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945} orlisoos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" orlisoos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\IsInstalled = "1" orlisoos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4F424A49-5955-4945-4F42-4A4959554945}\StubPath = "C:\\Windows\\system32\\eatrooteam-ogeab.exe" orlisoos.exe - Sets file execution options in registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe orlisoos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" orlisoos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ahfeasoc-eadat.exe" orlisoos.exe - Executes dropped EXE 2 IoCs
pid Process 3248 orlisoos.exe 1808 orlisoos.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600" orlisoos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600" orlisoos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "25600" orlisoos.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600" orlisoos.exe - Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} orlisoos.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify orlisoos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" orlisoos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\odcoageas.dll" orlisoos.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" orlisoos.exe - Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\orlisoos.exe bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f.exe File opened for modification C:\Windows\SysWOW64\ahfeasoc-eadat.exe orlisoos.exe File opened for modification C:\Windows\SysWOW64\eatrooteam-ogeab.exe orlisoos.exe File created C:\Windows\SysWOW64\odcoageas.dll orlisoos.exe File opened for modification C:\Windows\SysWOW64\orlisoos.exe orlisoos.exe File opened for modification C:\Windows\SysWOW64\orlisoos.exe bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f.exe File created C:\Windows\SysWOW64\eatrooteam-ogeab.exe orlisoos.exe File opened for modification C:\Windows\SysWOW64\odcoageas.dll orlisoos.exe File created C:\Windows\SysWOW64\ahfeasoc-eadat.exe orlisoos.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 1808 orlisoos.exe 1808 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe 3248 orlisoos.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3248 orlisoos.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 940 wrote to memory of 3248 940 bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f.exe 83 PID 940 wrote to memory of 3248 940 bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f.exe 83 PID 940 wrote to memory of 3248 940 bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f.exe 83 PID 3248 wrote to memory of 1808 3248 orlisoos.exe 84 PID 3248 wrote to memory of 1808 3248 orlisoos.exe 84 PID 3248 wrote to memory of 1808 3248 orlisoos.exe 84 PID 3248 wrote to memory of 612 3248 orlisoos.exe 5 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56 PID 3248 wrote to memory of 3544 3248 orlisoos.exe 56
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f.exe"C:\Users\Admin\AppData\Local\Temp\bc8b266014ad2b5fb46d8519abad70c47c72525c8cfcd85dcea6f87519e8cb5f.exe"2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\orlisoos.exe"C:\Windows\SysWOW64\orlisoos.exe"3⤵
- Windows security bypass
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\orlisoos.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1808
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ahfeasoc-eadat.exe
- Size 74KB
- SHA256 0226065bef0e1b74b285a9feb1534c3523063fedbd17495f9c14edfb22a43d79
- MD5 e6da35e2a2c6aa6f24f98ab8ee6ca3f4
- SHA1 062f1b603e44ca266138225b1f80a7e721fa36b8
- SHA512 396e8dd7b8d5f46db30b2081f8f12c00e97105bde82617b6df57d12154ab7ed10bec49ca842dfbefa182ec518ae249f80dc5e43fa19348e95d96a9ac88a2c6e7
- SSDEEP 1536:1v1Po/bQ+2Ovwd7o7mUj2JB1I32MZ1Rb/NW/Cxjtme1MedH:t1PoTQ+2Ovwd7o7m02z1I32MnRzqIf1R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\eatrooteam-ogeab.exe
- Size 73KB
- SHA256 291952515907f866dfaa92e0b59c98ba9c001b2651a33a3e2b5355a4b635ef28
- MD5 cf05c2a5debc8dbc8807f449fdeba705
- SHA1 b3f0b22dc09209b411ebcab7e3e87a745bb8a863
- SHA512 09e3d0ea42748fef20443668c8cb82c5c66fd1a1df69da9b787fda5793e28c69c0dd405bcfc5f7cf49e14f9de1e7e3f9cd32967026ee37683b7fdc935796d184
- SSDEEP 1536:xfEVrBeB9l909Lt7OpE4oUj1JYGE5pgkQRN2cm1x/fO:iVA9lwtz4/WQRN2b1pG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\odcoageas.dll
- Size 5KB
- SHA256 76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
- MD5 f37b21c00fd81bd93c89ce741a88f183
- SHA1 b2796500597c68e2f5638e1101b46eaf32676c1c
- SHA512 252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
- SSDEEP 48:6/bHgJ2GVhcus1lli4NbE2eMGjofSA8YDITcSd3MA3MMIv0BvcvXQ3:yAJ2G6Vx5EUGU6wIASdcAcHvA3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\orlisoos.exe
- Size 71KB
- SHA256 4ea549a543dddbeeec3a5be637af7b85d26218a3869084dbd3318b70a350f0ba
- MD5 0c4ebaedb61c2e018d1990e6617ceb3b
- SHA1 c0dfc35e0c2aac0604cf7cac672413811ec52075
- SHA512 eb224a2c3b199818437f37f32e0590262d88a1f44ed70f84cd10e1504c1b28c968c5a2889be94ca9f042af6cf10d94d94ccedb3da99e452baba113475b369e75
- SSDEEP 1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1Hw8slx:Olg35GTslA5t3/w8w
- MD5 SHA1 SHA512 SSDEEP