Analysis
-
max time kernel
46s -
max time network
18s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
19-09-2024 00:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
onibye-1.7.2.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
1800 seconds
Behavioral task
behavioral2
Sample
onibye-1.7.2.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
1800 seconds
Behavioral task
behavioral3
Sample
onibye-1.7.2.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
1800 seconds
Behavioral task
behavioral4
Sample
onibye-1.7.2.exe
Resource
win11-20240802-en
windows11-21h2-x64
5 signatures
1800 seconds
General
-
Target
onibye-1.7.2.exe
-
Size
248KB
-
MD5
8d31aa8f14a9cc51fd4c75cdd4f49c9f
-
SHA1
195582375e498afbd5be9230666a2fb4ce54d47b
-
SHA256
cd618c86273a76fb918299934424b52019e36e15631b3fcc33bdb2c95e770f1f
-
SHA512
6fc7477943fa60bdd53f4ecdc421d25e149e05a544c8fb3596d0342a94e59e0407b1b8fd709ae90134989be2b8b9b80e726b662ecaa646a6fb9bab2cf9c53bf2
-
SSDEEP
6144:hPp6X3u1/jnL5TXLcZB2/6RKqEvLeu1/Fb1o:JL5T7cZB2/6RDi1o
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3640 created 556 3640 onibye-1.7.2.exe 5 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language onibye-1.7.2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language onibye-1.7.2.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 3640 onibye-1.7.2.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3640 onibye-1.7.2.exe Token: SeDebugPrivilege 4636 onibye-1.7.2.exe Token: SeDebugPrivilege 4636 onibye-1.7.2.exe Token: SeDebugPrivilege 5068 taskmgr.exe Token: SeSystemProfilePrivilege 5068 taskmgr.exe Token: SeCreateGlobalPrivilege 5068 taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe 5068 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3640 wrote to memory of 4636 3640 onibye-1.7.2.exe 74 PID 3640 wrote to memory of 4636 3640 onibye-1.7.2.exe 74 PID 3640 wrote to memory of 4636 3640 onibye-1.7.2.exe 74
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\onibye-1.7.2.exe"C:\Users\Admin\AppData\Local\Temp\onibye-1.7.2.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
C:\Users\Admin\AppData\Local\Temp\onibye-1.7.2.exe"C:\Users\Admin\AppData\Local\Temp\onibye-1.7.2.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5068
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
425B
MD5605f809fab8c19729d39d075f7ffdb53
SHA1c546f877c9bd53563174a90312a8337fdfc5fdd9
SHA2566904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556
SHA51282cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3