3260c1e806429a61577901fcdf070a19d150730fbfc12c626279fd032d1b0d30

Analysis

max time kernel
151s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OGFnPatcher.exe
Size

177.3MB
MD5

2aa230791e5c7240b4c19e36e110d18a
SHA1

0c3effc9d7267399fb58381113597174d4407e11
SHA256

5033306349e087fa783444df5aaf2dac54d47d97383e19461cc599b014efb86b
SHA512

118fa5a980ff25bbc4a2852ecdff8fab364aace5ea37fd735f6bcbea40bbcaeb7c450041a9cfa6785542a92e5c80a5134350d7e6d3161fc51da99948444834e7
SSDEEP

1572864:s+vbimZ3RqPfrrW/GDt+wy2tXgJdtEaxMz6lMp1rJ/Gk/QeF/anRq9A4CGdhVnau:sA5kyGScXQT

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
24	raw.githubusercontent.com
29	raw.githubusercontent.com
30	raw.githubusercontent.com
33	raw.githubusercontent.com
32	raw.githubusercontent.com
23	raw.githubusercontent.com
25	raw.githubusercontent.com
26	raw.githubusercontent.com
27	raw.githubusercontent.com
28	raw.githubusercontent.com
31	raw.githubusercontent.com

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2116	OGFnPatcher.exe
2116	OGFnPatcher.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe
Token: SeShutdownPrivilege	3316	OGFnPatcher.exe
Token: SeCreatePagefilePrivilege	3316	OGFnPatcher.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 1728	3316	OGFnPatcher.exe	97
PID 3316 wrote to memory of 5008	3316	OGFnPatcher.exe	98
PID 3316 wrote to memory of 5008	3316	OGFnPatcher.exe	98
PID 3316 wrote to memory of 2116	3316	OGFnPatcher.exe	115
PID 3316 wrote to memory of 2116	3316	OGFnPatcher.exe	115

C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
"C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\patcher" --gpu-preferences=UAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2124,i,16807973909957545211,8435006259466585728,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1728
- C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\patcher" --field-trial-handle=2344,i,16807973909957545211,8435006259466585728,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  PID:5008
- C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\OGFnPatcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\patcher" --gpu-preferences=UAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2812,i,16807973909957545211,8435006259466585728,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
1⤵
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-7-0x00000194E7470000-0x00000194E7471000-memory.dmp

Filesize
4KB

Download
memory/2116-6-0x00000194E7470000-0x00000194E7471000-memory.dmp

Filesize
4KB

Download
memory/2116-5-0x00000194E7470000-0x00000194E7471000-memory.dmp

Filesize
4KB

Download
memory/2116-11-0x00000194E7470000-0x00000194E7471000-memory.dmp

Filesize
4KB

Download
memory/2116-15-0x00000194E7470000-0x00000194E7471000-memory.dmp

Filesize
4KB

Download
memory/2116-17-0x00000194E7470000-0x00000194E7471000-memory.dmp

Filesize
4KB

Download
memory/2116-16-0x00000194E7470000-0x00000194E7471000-memory.dmp

Filesize
4KB

Download
memory/2116-14-0x00000194E7470000-0x00000194E7471000-memory.dmp

Filesize
4KB

Download
memory/2116-13-0x00000194E7470000-0x00000194E7471000-memory.dmp

Filesize
4KB

Download
memory/2116-12-0x00000194E7470000-0x00000194E7471000-memory.dmp

Filesize
4KB

Download