Overview
overview
10Static
static
3OASIS AIO TOOL.rar
windows7-x64
1OASIS AIO TOOL.rar
windows10-2004-x64
1AdbWinApi.dll
windows7-x64
3AdbWinApi.dll
windows10-2004-x64
3OASIS AIO ...pi.dll
windows7-x64
3OASIS AIO ...pi.dll
windows10-2004-x64
3OASIS AIO ...OL.exe
windows7-x64
4OASIS AIO ...OL.exe
windows10-2004-x64
4OASIS AIO ...db.exe
windows7-x64
10OASIS AIO ...db.exe
windows10-2004-x64
10SHREDDER AIO TOOL.exe
windows7-x64
4SHREDDER AIO TOOL.exe
windows10-2004-x64
4adb.exe
windows7-x64
3adb.exe
windows10-2004-x64
3Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/12/2024, 18:47
Static task
static1
Behavioral task
behavioral1
Sample
OASIS AIO TOOL.rar
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
OASIS AIO TOOL.rar
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
AdbWinApi.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
AdbWinApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
OASIS AIO TOOL/AdbWinApi.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
OASIS AIO TOOL/AdbWinApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
OASIS AIO TOOL/SHREDDER AIO TOOL.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
OASIS AIO TOOL/SHREDDER AIO TOOL.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
OASIS AIO TOOL/adb.exe
Resource
win7-20241023-en
Behavioral task
behavioral10
Sample
OASIS AIO TOOL/adb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
SHREDDER AIO TOOL.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
SHREDDER AIO TOOL.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
adb.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
adb.exe
Resource
win10v2004-20241007-en
General
-
Target
SHREDDER AIO TOOL.exe
-
Size
19.8MB
-
MD5
e0cf0457dac4e4acbdb265640c310270
-
SHA1
06bc3b50f8b74537f41e8f0401af339a125ded12
-
SHA256
3ca75f1ed33faeb3816c489498e8aa81d3180ab241378c5fbf42e66fadd0bfa0
-
SHA512
cd3e46ff692dddbd1538745328d07a6c777a82af5bdbb3685bfc203755028e011671bd7655480e6e871a6e174ec582eb47ee00cd5c1da81e1b58a07f0a29c7f9
-
SSDEEP
393216:6J5iiX1Wk0Hhnbzsv3e7sCdFVAXMSnKmA6a20fchaHUR:EllB0ZsvO7sCvg3a20fcBR
Malware Config
Signatures
-
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\Web\Wallpaper\normal.ico SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\CCleaner64.exe SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\renderer_dx.zip SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\ros.bat SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\HWIDkey_Changer.exe SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\DefenderControl.exe SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\adv.bat SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\helper SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\keymapping.zip SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\click.wav SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\WinUpdatesDisabler_x64.exe SHREDDER AIO TOOL.exe File opened for modification C:\Windows\Web\Wallpaper\UserCustom.ini SHREDDER AIO TOOL.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1004 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1004 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3420 SHREDDER AIO TOOL.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHREDDER AIO TOOL.exe"C:\Users\Admin\AppData\Local\Temp\SHREDDER AIO TOOL.exe"1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:3420
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x304 0x4a01⤵
- Suspicious use of AdjustPrivilegeToken
PID:1004
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5be1a290e146ab2237b50c85756a46cc5
SHA159f000a9c1c5f691c7c44f6ea0e0e8fa2b38d0f2
SHA256c5dfc83f5729847ac52f3c18658674589ea6f0a8b4c80a044749e0fdedd5f3b8
SHA51207772297d8abd5f8b873af3d05f9ab147c0b17fe105bd9a9188bfbc7d219556e401372bcde5467ef7f9211ba4ec3b53b078db61262ae25d838416e66662eb512