e61cd891100477911a95c3422647bc25475e95b4f68473e68cd49180ef6e1f09

Analysis

user interaction
yes
max time kernel
150s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ocean-K3W5O4F4 (1).exe
Size 44.4MB
Sample260711-2glqfaaz2r
SHA256 e61cd891100477911a95c3422647bc25475e95b4f68473e68cd49180ef6e1f09
MD5 8e6bac9865ed77c989bbf6edd814e470
SHA1 6640af057300bd119fe3c386299c316d027abec1
SHA512 43177cfb4168bbf354808d071a233dd92af42c69b1e8a1e0b4c3da332de9fc456a9bc3d91591b4a8e9a8c26ee9d26f3dab3487717a3598319dd513a559203775
SSDEEP 786432:yNL9sNDWrkQppYBbmsdxqBG28M6y+rMhmRjL6Bnc9dXlNAptmwHBuQ+hv3IH:yQQwQDuRCs28M6lwieBodSwQcv
TLSH
T1BAA7338B3041659BCC90A238C30978ACF046FF564C7652DBDEACB9695DB016DEEF1938
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2644	Ocean-K3W5O4F4 (1).exe
2644	Ocean-K3W5O4F4 (1).exe

Executes dropped EXE 1 IoCs

pid	Process
3080	OceanGraper.sys

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
400	sc.exe
5160	sc.exe
1712	sc.exe
3448	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2644	Ocean-K3W5O4F4 (1).exe
2644	Ocean-K3W5O4F4 (1).exe
2644	Ocean-K3W5O4F4 (1).exe
2644	Ocean-K3W5O4F4 (1).exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeDebugPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeLoadDriverPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeLoadDriverPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeLoadDriverPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeLoadDriverPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeLoadDriverPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeLoadDriverPrivilege	4900	fltMC.exe
Token: SeLoadDriverPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: 33	2644	Ocean-K3W5O4F4 (1).exe
Token: SeIncBasePriorityPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeIncreaseQuotaPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeSecurityPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeTakeOwnershipPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeLoadDriverPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeSystemProfilePrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeSystemtimePrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeProfSingleProcessPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeIncBasePriorityPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeCreatePagefilePrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeBackupPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeRestorePrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeShutdownPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeDebugPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeSystemEnvironmentPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeRemoteShutdownPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeUndockPrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeManageVolumePrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: 33	2644	Ocean-K3W5O4F4 (1).exe
Token: 34	2644	Ocean-K3W5O4F4 (1).exe
Token: 35	2644	Ocean-K3W5O4F4 (1).exe
Token: 36	2644	Ocean-K3W5O4F4 (1).exe
Token: SeSystemtimePrivilege	2644	Ocean-K3W5O4F4 (1).exe
Token: SeSystemtimePrivilege	2644	Ocean-K3W5O4F4 (1).exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2644	Ocean-K3W5O4F4 (1).exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 4900	2644	Ocean-K3W5O4F4 (1).exe	87
PID 2644 wrote to memory of 3448	2644	Ocean-K3W5O4F4 (1).exe	89
PID 2644 wrote to memory of 400	2644	Ocean-K3W5O4F4 (1).exe	91
PID 2644 wrote to memory of 1256	2644	Ocean-K3W5O4F4 (1).exe	93
PID 2644 wrote to memory of 5160	2644	Ocean-K3W5O4F4 (1).exe	95
PID 2644 wrote to memory of 1712	2644	Ocean-K3W5O4F4 (1).exe	98

C:\Users\Admin\AppData\Local\Temp\Ocean-K3W5O4F4 (1).exe
"C:\Users\Admin\AppData\Local\Temp\Ocean-K3W5O4F4 (1).exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload OceanGraper
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4900
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop OceanGraper
  2⤵
  - Launches sc.exe
  PID:3448
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete OceanGraper
  2⤵
  - Launches sc.exe
  PID:400
- C:\Windows\System32\fltMC.exe
  "C:\Windows\System32\fltMC.exe" unload Ocean service grapper
  2⤵
  PID:1256
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop Ocean service grapper
  2⤵
  - Launches sc.exe
  PID:5160
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete Ocean service grapper
  2⤵
  - Launches sc.exe
  PID:1712

C:\Users\Admin\.oceancache\OceanGraper.sys
C:\Users\Admin\.oceancache\OceanGraper.sys
1⤵
- Executes dropped EXE
PID:3080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

OceanGraper.sys

Path C:\Users\Admin\.oceancache\OceanGraper.sys
Size 23KB
SHA256 4f412f9aa89994cda45422d23d6d961809225de9a4f5a8bfbfb9ac0e8725917e
MD5 3ee985c5fd1f5784e15a4d11b3ca70a1
SHA1 33148c93465908ddad71cf189e22091dc0058ac4
SHA512 65fa049521fd659debd7986b80a3ab67f20281b2ed8f37213a46fce1495c1d2391c42e93ac8b1c0c593bbeb284c867a8484b99cfea20a889c30e37febed32981
SSDEEP 384:0OaLMjdtjzvWPkgnrJrc8c5oQiWKx1ah3liYlORR9zu3:PaYjwkgn23Y23lBK9zA
TLSH
T171B25BC1C56810C2CA6A7C78C3A4EA53BD3D739713219ADB06A9D6650F533C9BB3861E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2644-0-0x00007FFB586D0000-0x00007FFB586D2000-memory.dmp

Download

memory/2644-1-0x00007FFB586E0000-0x00007FFB586E2000-memory.dmp

Download

memory/2644-2-0x0000000140000000-0x0000000141000000-memory.dmp

Download