Analysis
-
max time kernel
110s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
06/08/2024, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
63c398664990d386ac7effaf3625bed0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
63c398664990d386ac7effaf3625bed0N.exe
Resource
win10v2004-20240802-en
General
-
Target
63c398664990d386ac7effaf3625bed0N.exe
-
Size
45KB
-
MD5
63c398664990d386ac7effaf3625bed0
-
SHA1
96fd8d39864525335d225a9ab39d6f703c816526
-
SHA256
08fb2fa5fb0ef7dda771ba1dbd4f3c3e63a5fccb616c099200a146632d24193e
-
SHA512
99ff1da61f8810d50892204dd384824f024c739be3b286bafb189b8579bb2c48ab5f768966f8ef9ec4a950533fcc2bcba929ab0b9d7a12ef1987e257fa648386
-
SSDEEP
768:ED42XHw/tc682BrQVVoiIew3w2I0lFPVd+Izo+7PcrOWqKuRIx47mYXc/1H5C:Ecmw/tc682ROoiox1rVd+IjgOWqKuRFd
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Olehbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Olehbh32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oclpdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oclpdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" 63c398664990d386ac7effaf3625bed0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Omddmkhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Onfadc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oepianef.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad 63c398664990d386ac7effaf3625bed0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}" Oiiilm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Omddmkhl.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Onfadc32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oiiilm32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad Oepianef.exe -
Executes dropped EXE 7 IoCs
pid Process 2304 Olehbh32.exe 1572 Oclpdf32.exe 2700 Oiiilm32.exe 2832 Omddmkhl.exe 2732 Onfadc32.exe 1412 Oepianef.exe 2612 Ohnemidj.exe -
Loads dropped DLL 18 IoCs
pid Process 1732 63c398664990d386ac7effaf3625bed0N.exe 1732 63c398664990d386ac7effaf3625bed0N.exe 2304 Olehbh32.exe 2304 Olehbh32.exe 1572 Oclpdf32.exe 1572 Oclpdf32.exe 2700 Oiiilm32.exe 2700 Oiiilm32.exe 2832 Omddmkhl.exe 2832 Omddmkhl.exe 2732 Onfadc32.exe 2732 Onfadc32.exe 1412 Oepianef.exe 1412 Oepianef.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe 2680 WerFault.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File created C:\Windows\SysWOW64\Oclpdf32.exe Olehbh32.exe File created C:\Windows\SysWOW64\Oiiilm32.exe Oclpdf32.exe File created C:\Windows\SysWOW64\Qenpjecb.dll Oclpdf32.exe File opened for modification C:\Windows\SysWOW64\Omddmkhl.exe Oiiilm32.exe File created C:\Windows\SysWOW64\Onfadc32.exe Omddmkhl.exe File opened for modification C:\Windows\SysWOW64\Oepianef.exe Onfadc32.exe File created C:\Windows\SysWOW64\Olehbh32.exe 63c398664990d386ac7effaf3625bed0N.exe File opened for modification C:\Windows\SysWOW64\Oclpdf32.exe Olehbh32.exe File opened for modification C:\Windows\SysWOW64\Onfadc32.exe Omddmkhl.exe File created C:\Windows\SysWOW64\Jgjgfacn.dll Omddmkhl.exe File created C:\Windows\SysWOW64\Ohnemidj.exe Oepianef.exe File opened for modification C:\Windows\SysWOW64\Ohnemidj.exe Oepianef.exe File created C:\Windows\SysWOW64\Oepianef.exe Onfadc32.exe File created C:\Windows\SysWOW64\Nafbcl32.dll Onfadc32.exe File opened for modification C:\Windows\SysWOW64\Olehbh32.exe 63c398664990d386ac7effaf3625bed0N.exe File created C:\Windows\SysWOW64\Imfkindn.dll 63c398664990d386ac7effaf3625bed0N.exe File created C:\Windows\SysWOW64\Hpamlo32.dll Olehbh32.exe File opened for modification C:\Windows\SysWOW64\Oiiilm32.exe Oclpdf32.exe File created C:\Windows\SysWOW64\Omddmkhl.exe Oiiilm32.exe File created C:\Windows\SysWOW64\Gobhkhgi.dll Oiiilm32.exe File created C:\Windows\SysWOW64\Fifjgemj.dll Oepianef.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2680 2612 WerFault.exe 35 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Olehbh32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oclpdf32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oiiilm32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Omddmkhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Onfadc32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oepianef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ohnemidj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63c398664990d386ac7effaf3625bed0N.exe -
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 63c398664990d386ac7effaf3625bed0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpamlo32.dll" Olehbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oclpdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Omddmkhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Onfadc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 63c398664990d386ac7effaf3625bed0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" 63c398664990d386ac7effaf3625bed0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oclpdf32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Onfadc32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qenpjecb.dll" Oclpdf32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oiiilm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gobhkhgi.dll" Oiiilm32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oepianef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Oiiilm32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Omddmkhl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgjgfacn.dll" Omddmkhl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 63c398664990d386ac7effaf3625bed0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738} 63c398664990d386ac7effaf3625bed0N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imfkindn.dll" 63c398664990d386ac7effaf3625bed0N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Olehbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment" Olehbh32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nafbcl32.dll" Onfadc32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32 Oepianef.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fifjgemj.dll" Oepianef.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2304 1732 63c398664990d386ac7effaf3625bed0N.exe 29 PID 1732 wrote to memory of 2304 1732 63c398664990d386ac7effaf3625bed0N.exe 29 PID 1732 wrote to memory of 2304 1732 63c398664990d386ac7effaf3625bed0N.exe 29 PID 1732 wrote to memory of 2304 1732 63c398664990d386ac7effaf3625bed0N.exe 29 PID 2304 wrote to memory of 1572 2304 Olehbh32.exe 30 PID 2304 wrote to memory of 1572 2304 Olehbh32.exe 30 PID 2304 wrote to memory of 1572 2304 Olehbh32.exe 30 PID 2304 wrote to memory of 1572 2304 Olehbh32.exe 30 PID 1572 wrote to memory of 2700 1572 Oclpdf32.exe 31 PID 1572 wrote to memory of 2700 1572 Oclpdf32.exe 31 PID 1572 wrote to memory of 2700 1572 Oclpdf32.exe 31 PID 1572 wrote to memory of 2700 1572 Oclpdf32.exe 31 PID 2700 wrote to memory of 2832 2700 Oiiilm32.exe 32 PID 2700 wrote to memory of 2832 2700 Oiiilm32.exe 32 PID 2700 wrote to memory of 2832 2700 Oiiilm32.exe 32 PID 2700 wrote to memory of 2832 2700 Oiiilm32.exe 32 PID 2832 wrote to memory of 2732 2832 Omddmkhl.exe 33 PID 2832 wrote to memory of 2732 2832 Omddmkhl.exe 33 PID 2832 wrote to memory of 2732 2832 Omddmkhl.exe 33 PID 2832 wrote to memory of 2732 2832 Omddmkhl.exe 33 PID 2732 wrote to memory of 1412 2732 Onfadc32.exe 34 PID 2732 wrote to memory of 1412 2732 Onfadc32.exe 34 PID 2732 wrote to memory of 1412 2732 Onfadc32.exe 34 PID 2732 wrote to memory of 1412 2732 Onfadc32.exe 34 PID 1412 wrote to memory of 2612 1412 Oepianef.exe 35 PID 1412 wrote to memory of 2612 1412 Oepianef.exe 35 PID 1412 wrote to memory of 2612 1412 Oepianef.exe 35 PID 1412 wrote to memory of 2612 1412 Oepianef.exe 35 PID 2612 wrote to memory of 2680 2612 Ohnemidj.exe 36 PID 2612 wrote to memory of 2680 2612 Ohnemidj.exe 36 PID 2612 wrote to memory of 2680 2612 Ohnemidj.exe 36 PID 2612 wrote to memory of 2680 2612 Ohnemidj.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c398664990d386ac7effaf3625bed0N.exe"C:\Users\Admin\AppData\Local\Temp\63c398664990d386ac7effaf3625bed0N.exe"1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\Olehbh32.exeC:\Windows\system32\Olehbh32.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\Oclpdf32.exeC:\Windows\system32\Oclpdf32.exe3⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\Oiiilm32.exeC:\Windows\system32\Oiiilm32.exe4⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\Omddmkhl.exeC:\Windows\system32\Omddmkhl.exe5⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\Onfadc32.exeC:\Windows\system32\Onfadc32.exe6⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\SysWOW64\Oepianef.exeC:\Windows\system32\Oepianef.exe7⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\Ohnemidj.exeC:\Windows\system32\Ohnemidj.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 1409⤵
- Loads dropped DLL
- Program crash
PID:2680
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5f823d91d930ae2822b47b6c8300c0e3f
SHA1f238e8081ee03f786f3fe40836270d5b1dbdf5a0
SHA2566c01c02f66b12e5379b00f2bf70fafa7733f8ed4840d0c2c214be825c05008a3
SHA512e0dd06e30456176fdef886be21b422746988bf6a5a9c1c91979f1e404c8e8f3d926af4a1e192f542d103b605cc5bcf6584902e73213a8698e0c6ab7aa60594a8
-
Filesize
45KB
MD5384b29ed4993ae222939b21a35085a59
SHA172f7afbe72692d3523fa2095027dce21cf0f6e73
SHA2560f586608e7f8982c14538b220380172fe66b1c0b010b9c803dceca0953379d42
SHA512e75e969a7561da0d2e5941be0de744541ef55612fddc825f51af6388215d72c2ff291b585044ed9b5fa8b14ca808f372b1eb41b2c046542c50878b251472e615
-
Filesize
45KB
MD57a210b2fcb0793d0569c398376f994ac
SHA1055ca335222eb0a103203f805e9ef0d5e7585c60
SHA256d77cede015a38e3b1eb3890acc596dff3a394d4fad7fac37b185345095847659
SHA512f6cd06daf081f75bdb7d05fec160ed459eb4514c5afadd47301aaaa426844440348355a8bc267c2272cb3ddae9aa17f5ad9688d32bf0c08b2272ddbb9752c776
-
Filesize
45KB
MD560198b5f3d42f29df0681d513c97faab
SHA1e516a7988e68256562f4145c468f6a9b1ecdcb0a
SHA25653fadc7b58dac871983aa1545ce64f19cc96a8e6fe54dc4d119a769192ccc6a8
SHA512d7b9cbdb29103026a1386cee82e7aa5ccb754dd6c12572828474f272ad1ed02864b74c6a5278335accc175c40ee684ed23e53f12770d4d6938fe856bdf40afab
-
Filesize
45KB
MD5377f3bd8ddc0506fba119ddc17e395f9
SHA17b0ea97b512e3c6cf9e6c3aefd8e8d99caf78be0
SHA2561d50cf221546196b3fd424569371a31688e2f8ec1d4b97ec56c60731d4e75b7b
SHA5121b1ef2aaf3d47a1c3bfd0cf4f1ca1453dfcf73ad91f91bd7556ebd7e35bfe560ae6a04e3f0e4e9e9cad69cfa6d074e12724468340c6407c65793511be13ec12f
-
Filesize
45KB
MD5f10d09e3e43c46227f8ddea033579515
SHA18f1a52cfc89411db25e497725b44fcfb740ec811
SHA2562a1badcb9b4367efee4330560ebfdf0ca929c907e8918ab5dbe6c97522ab7b42
SHA512af2aa3e8f3fdc79b1cedc58fd1335f12a6f475a41afc9f01757b2cc2e3a7cb84adfc4ed9b74d5e2fc9040b2736e01c13f9d83bb4c93e045c77ffee6670a9cade
-
Filesize
45KB
MD52f92c791f47f9713ca4a23916d719a40
SHA1b2217b243dfd35b8c19330e2f85bd1b7705f740d
SHA25662c8b28074b32078be662688d40bee4b28979d2c88f779990a179e0531987637
SHA5127c4eab1dd684a36651c8d4cf2773f4194b4622c7ea30f2ba83cb7694f2a3dfe58f77d2ce7f71caa3040f1a5d72fccdbb0ffa12a7e78a777c13946bee8a222e7a