Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/08/2024, 05:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe
Resource
win7-20240708-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe
-
Size
89KB
-
MD5
e7e6bb99632eb1037d33f5a3d7394f4d
-
SHA1
8a630d9115f32a2ca1907eaf53c2c5b907662251
-
SHA256
fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85
-
SHA512
605e89a0ea8af26c0c8ebe7f9c2f4d23f9e21b73de6034b541f93c94dede8b45432d85bc06a58c6155d44628bf8b0031f14442040ff80f07d92b2dfd8102c5e1
-
SSDEEP
1536:se2sLc0T1ddPDNTGd8Lxqa8lG+DhisVOKYNlb8dxQ9v:d2sLJ1djdEaexVisIKYNlNv
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" oudpoopoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" oudpoopoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" oudpoopoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" oudpoopoas.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E4E594A-5a41-4850-4E4E-594A5A414850} oudpoopoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E4E594A-5a41-4850-4E4E-594A5A414850}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" oudpoopoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E4E594A-5a41-4850-4E4E-594A5A414850}\IsInstalled = "1" oudpoopoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4E4E594A-5a41-4850-4E4E-594A5A414850}\StubPath = "C:\\Windows\\system32\\eafleabat.exe" oudpoopoas.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe oudpoopoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" oudpoopoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\impesut-acid.exe" oudpoopoas.exe -
Executes dropped EXE 2 IoCs
pid Process 1712 oudpoopoas.exe 2704 oudpoopoas.exe -
Loads dropped DLL 3 IoCs
pid Process 2280 fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe 2280 fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe 1712 oudpoopoas.exe -
resource yara_rule behavioral1/files/0x00080000000120fb-1.dat upx behavioral1/memory/2280-2-0x0000000000020000-0x0000000000038000-memory.dmp upx behavioral1/memory/1712-10-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/1712-76-0x0000000000400000-0x0000000000418000-memory.dmp upx behavioral1/memory/2704-92-0x0000000000400000-0x0000000000418000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "24064" oudpoopoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "24064" oudpoopoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "24064" oudpoopoas.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "24064" oudpoopoas.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger oudpoopoas.exe -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} oudpoopoas.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify oudpoopoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" oudpoopoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\okpoatoat.dll" oudpoopoas.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" oudpoopoas.exe -
Drops file in System32 directory 17 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\aset32.exe oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\impesut-acid.exe oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL oudpoopoas.exe File created C:\Windows\SysWOW64\oudpoopoas.exe fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe File opened for modification C:\Windows\SysWOW64\okpoatoat.dll oudpoopoas.exe File created C:\Windows\SysWOW64\okpoatoat.dll oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\gymspzd.dll oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\oudpoopoas.exe fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe File created C:\Windows\SysWOW64\impesut-acid.exe oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\eafleabat.exe oudpoopoas.exe File created C:\Windows\SysWOW64\eafleabat.exe oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\rmass.exe oudpoopoas.exe File opened for modification C:\Windows\SysWOW64\oudpoopoas.exe oudpoopoas.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\System\gymspzd.dll oudpoopoas.exe File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe oudpoopoas.exe File opened for modification C:\Program Files (x86)\Common Files\System\rmass.exe oudpoopoas.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe oudpoopoas.exe File opened for modification C:\Program Files (x86)\Common Files\System\ahuy.exe oudpoopoas.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe oudpoopoas.exe File opened for modification C:\Program Files (x86)\Common Files\System\ntdbg.exe oudpoopoas.exe File opened for modification C:\Program Files (x86)\Common Files\System\RECOVER32.DLL oudpoopoas.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oudpoopoas.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 2704 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe 1712 oudpoopoas.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1712 oudpoopoas.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1712 2280 fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe 30 PID 2280 wrote to memory of 1712 2280 fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe 30 PID 2280 wrote to memory of 1712 2280 fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe 30 PID 2280 wrote to memory of 1712 2280 fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe 30 PID 1712 wrote to memory of 432 1712 oudpoopoas.exe 5 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 2704 1712 oudpoopoas.exe 31 PID 1712 wrote to memory of 2704 1712 oudpoopoas.exe 31 PID 1712 wrote to memory of 2704 1712 oudpoopoas.exe 31 PID 1712 wrote to memory of 2704 1712 oudpoopoas.exe 31 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21 PID 1712 wrote to memory of 1216 1712 oudpoopoas.exe 21
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe"C:\Users\Admin\AppData\Local\Temp\fa942c291c3e28d763540e7aad36adbc1113b6fdbb2103e44a62635e932f0e85.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\oudpoopoas.exe"C:\Windows\SysWOW64\oudpoopoas.exe"3⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\oudpoopoas.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2704
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD53e7c2723840f804ee02b38234a17b6d5
SHA1f42c7f352599fa5c0956b55310b6afe834f5effa
SHA256c8aa96a56573148b5727b95c85b7257b29cdb4f9028b1ebc0b94f70ce33e2268
SHA5123ba55ba79b6e574a75864061a29605d41841350db3671ed3d1bfe8f2647bffd45fe32ed354e46ee37e518cdffa767c90cdc283ab784d8ac368386acb6f0a651f
-
Filesize
90KB
MD5e0db7847dbff8f1b6664fd8f64a4b444
SHA12507aa072dffe2107ec5e2b04d9cda2f73fd4a75
SHA256c214c61e46d21829910d3b7076a7458de1e6e6d190e1bff2441a6d79873d27f4
SHA512bebbfa5f5a346168cc522456b294ee9889e2f945776389e8b41a405477ce9b3417eddcb6460678fdaaf4224e8b1acc65777d621a0ba07fe73e674fca2c3c0d0b
-
Filesize
5KB
MD5c8521a5fdd1c9387d536f599d850b195
SHA1a543080665107b7e32bcc1ed19dbfbc1d2931356
SHA256fa8f77b6daf775d66de9d27c1d896168a792057358e518c00e72b8964b966ca5
SHA512541500e2cd502852a007d29badc1a1848d187245f78ec272281bab290cc6e308f0ae6d1b96863e0c30a176b16c6cf7e63e08a8de81a84615e4710e7164a805cd
-
Filesize
87KB
MD59af5f91d5084605aa21d4522cd91e9bf
SHA1453120907e13264ff4343c50a62b980aaf7fc5bf
SHA2565ebad97566148fcae892a264f42522b0ec45c36539305eb4eba5523a93de6d36
SHA5123ae783b7df1a87e6628a9c4fd3d745fcc15dbe82f9000c630101c12a1b0500967e8379647e72f1e79fff49d8daf351055bc8f7c3f6351230e20f0e51d4fdfb5d