Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12-10-2024 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OceanicTools.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
OceanicTools.exe
Resource
win10-20240404-en
windows10-1703-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
OceanicTools.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
OceanicTools.exe
-
Size
22.2MB
-
MD5
f975ef6b34160bff3ba3c8c815f9e77c
-
SHA1
4b818a41b68f8ed6f6719db14e19f955a60aebe8
-
SHA256
ae04f1bc929f6f83a4010f59fcc1f78caea5d198ae3779c7e058608effcc56af
-
SHA512
ba08c564b363affea6c39394955feb327a6c15cde9a5b83806088fcfdb4b4464deb24dcbca0e2cb5f26ae9172d7c8fb94ed58e0a534bf21deb4957363f67a222
-
SSDEEP
98304:XHE3AU4FiZ0ZXawT/2MMlOLG9ffkTj8cywcAk:U3u0Z0EdM1LGdUjKA
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 888 wmic.exe Token: SeSecurityPrivilege 888 wmic.exe Token: SeTakeOwnershipPrivilege 888 wmic.exe Token: SeLoadDriverPrivilege 888 wmic.exe Token: SeSystemProfilePrivilege 888 wmic.exe Token: SeSystemtimePrivilege 888 wmic.exe Token: SeProfSingleProcessPrivilege 888 wmic.exe Token: SeIncBasePriorityPrivilege 888 wmic.exe Token: SeCreatePagefilePrivilege 888 wmic.exe Token: SeBackupPrivilege 888 wmic.exe Token: SeRestorePrivilege 888 wmic.exe Token: SeShutdownPrivilege 888 wmic.exe Token: SeDebugPrivilege 888 wmic.exe Token: SeSystemEnvironmentPrivilege 888 wmic.exe Token: SeRemoteShutdownPrivilege 888 wmic.exe Token: SeUndockPrivilege 888 wmic.exe Token: SeManageVolumePrivilege 888 wmic.exe Token: 33 888 wmic.exe Token: 34 888 wmic.exe Token: 35 888 wmic.exe Token: 36 888 wmic.exe Token: SeIncreaseQuotaPrivilege 888 wmic.exe Token: SeSecurityPrivilege 888 wmic.exe Token: SeTakeOwnershipPrivilege 888 wmic.exe Token: SeLoadDriverPrivilege 888 wmic.exe Token: SeSystemProfilePrivilege 888 wmic.exe Token: SeSystemtimePrivilege 888 wmic.exe Token: SeProfSingleProcessPrivilege 888 wmic.exe Token: SeIncBasePriorityPrivilege 888 wmic.exe Token: SeCreatePagefilePrivilege 888 wmic.exe Token: SeBackupPrivilege 888 wmic.exe Token: SeRestorePrivilege 888 wmic.exe Token: SeShutdownPrivilege 888 wmic.exe Token: SeDebugPrivilege 888 wmic.exe Token: SeSystemEnvironmentPrivilege 888 wmic.exe Token: SeRemoteShutdownPrivilege 888 wmic.exe Token: SeUndockPrivilege 888 wmic.exe Token: SeManageVolumePrivilege 888 wmic.exe Token: 33 888 wmic.exe Token: 34 888 wmic.exe Token: 35 888 wmic.exe Token: 36 888 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4800 wrote to memory of 3148 4800 OceanicTools.exe 73 PID 4800 wrote to memory of 3148 4800 OceanicTools.exe 73 PID 4800 wrote to memory of 888 4800 OceanicTools.exe 74 PID 4800 wrote to memory of 888 4800 OceanicTools.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\OceanicTools.exe"C:\Users\Admin\AppData\Local\Temp\OceanicTools.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SYSTEM32\reg.exe"reg" "query" "SYSTEM\CurrentControlSet\Services\Disk\Enum"2⤵PID:3148
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" "computersystem" "get" "manufacturer"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:888
-