Overview

overview

6

Static

static

1

oosu10premium_en.exe

windows10-2004-x64

6

oosu10premium_en.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/08/2026, 22:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    oosu10premium_en.exe
  • Size 62.1MB
  • Sample260821-2jhfssdk61
  • SHA256 3ac2831d8b7501518548adddbb9ef41a4e7e8c2990c2d321f1457b16bcfb7634
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 23 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 40 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\oosu10premium_en.exe
    "C:\Users\Admin\AppData\Local\Temp\oosu10premium_en.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /i "C:\ProgramData\OO Software\Installations\D52062EB8A56066F61EDE00393BC45E223151DDB.msi" AFFILIATE_ID=1000
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1516
      • C:\Program Files\OO Software\ShutUp10\OOSU10PE.exe
        "C:\Program Files\OO Software\ShutUp10\OOSU10PE.exe" /unelevated
        3⤵
        • Executes dropped EXE
        PID:3712
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9379973406BBB7818DE0EFA537C4FD80 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2620
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3664
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 4873EC072925BDCCBF35E36D3256B794
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1988
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 86013425F312A96F3F6B7A5B74928D8C E Global\MSI0000
        2⤵
        • Drops file in Windows directory
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1696
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4792
    • C:\Program Files\OO Software\ShutUp10\oosu10sv.exe
      "C:\Program Files\OO Software\ShutUp10\oosu10sv.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:5792
    • C:\Program Files\OO Software\ShutUp10\oosu10sv.exe
      "C:\Program Files\OO Software\ShutUp10\oosu10sv.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4424
    • C:\Program Files\OO Software\ShutUp10\OOSU10PE.exe
      "C:\Program Files\OO Software\ShutUp10\OOSU10PE.exe"
      1⤵
      • Adds Run key to start application
      • Drops file in Windows directory
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4408
    • C:\Program Files\OO Software\ShutUp10\OOSU10PE.EXE
      "C:\Program Files\OO Software\ShutUp10\OOSU10PE.exe" /AUTOSTART
      1⤵
      • Executes dropped EXE
      PID:4316

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a3674.rbs
          • Path C:\Config.Msi\e5a3674.rbs
          • Size 282KB
          • SHA256 fc5fc8e859f1b5de987d55f641ea3e42b519d50f64463d960daf272e86a2ece0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a3675.rbf
          • Path C:\Config.Msi\e5a3675.rbf
          • Size 2KB
          • SHA256 1d9e26731bbe1255bb7c98f2cbf708c716bd86b0f989d4976c2bc5cfba040d0f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          Microsoft.Extensions.DependencyInjection.Abstractions.dll
          • Path C:\Program Files\OO Software\ShutUp10\Microsoft.Extensions.DependencyInjection.Abstractions.dll
          • Size 63KB
          • SHA256 fd1d92dc1de8339f669123e23014e50c71cdf94383dfe0487593f0ca22d35fc7
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Extensions.Hosting.Abstractions.dll
          • Path C:\Program Files\OO Software\ShutUp10\Microsoft.Extensions.Hosting.Abstractions.dll
          • Size 51KB
          • SHA256 0a75ba2ff5873825d07e2c1b91cd0da91a406f5d9e093e89ade1201d5f7fc13c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Extensions.Hosting.WindowsServices.dll
          • Path C:\Program Files\OO Software\ShutUp10\Microsoft.Extensions.Hosting.WindowsServices.dll
          • Size 28KB
          • SHA256 e7513de3750d037c6f667d9d4a4036b3f88969817b095670711e3e427147b0c5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Microsoft.Extensions.Hosting.dll
          • Path C:\Program Files\OO Software\ShutUp10\Microsoft.Extensions.Hosting.dll
          • Size 69KB
          • SHA256 43d9fb7d845f69e2446584a4303ecc9e8b894045b5173eb511d775a758abfdbe
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OOSoftware.Shared.Lib.Base.dll
          • Path C:\Program Files\OO Software\ShutUp10\OOSoftware.Shared.Lib.Base.dll
          • Size 190KB
          • SHA256 1d29886ea1797d909b7036835fe7cde48dfb247ba8bf9fbfe3314e59d1525e49
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OOSoftware.ShutUp10.Service.Lib.dll
          • Path C:\Program Files\OO Software\ShutUp10\OOSoftware.ShutUp10.Service.Lib.dll
          • Size 90KB
          • SHA256 497089b4952c75c9dee5a7d73cfe0f9611eb24da653dc086448dad54fa386f0e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.Specialized.dll
          • Path C:\Program Files\OO Software\ShutUp10\System.Collections.Specialized.dll
          • Size 102KB
          • SHA256 9060cb537394bec915c1e57b0516725b1a7d5115b995da1857548f271330061f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Collections.dll
          • Path C:\Program Files\OO Software\ShutUp10\System.Collections.dll
          • Size 254KB
          • SHA256 e0c2f5d45c0b99d8afe0234e8527cc1097f220b6aa256ea751611c2d7763742e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.ComponentModel.Primitives.dll
          • Path C:\Program Files\OO Software\ShutUp10\System.ComponentModel.Primitives.dll
          • Size 78KB
          • SHA256 078f044ded212ad3e6f20bd4d1434bcb5c69165e1e128c97c5603e2d8cef58f1
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Configuration.ConfigurationManager.dll
          • Path C:\Program Files\OO Software\ShutUp10\System.Configuration.ConfigurationManager.dll
          • Size 1.0MB
          • SHA256 a7eb879d6e3fd7a661735b8a22c0acd15b3394f0f7728066313513e50f87036f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Diagnostics.Process.dll
          • Path C:\Program Files\OO Software\ShutUp10\System.Diagnostics.Process.dll
          • Size 330KB
          • SHA256 9c500ae62a3337d1209c9de3fe3fef18077b9eb3e091a591150208f16f2f6e66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.CoreLib.dll
          • Path C:\Program Files\OO Software\ShutUp10\System.Private.CoreLib.dll
          • Size 12.6MB
          • SHA256 20027d6cc9cf4c9c08d24d9c8319cbb233316a7f245c91c6c2ca7cb0f11d062c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Private.Uri.dll
          • Path C:\Program Files\OO Software\ShutUp10\System.Private.Uri.dll
          • Size 254KB
          • SHA256 9fa3db97acb6e635acd24be072678b32f5d6755118b816d928eb4c265c9971ce
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Runtime.dll
          • Path C:\Program Files\OO Software\ShutUp10\System.Runtime.dll
          • Size 42KB
          • SHA256 1b44e30c99ca6072b7e0ffd33287759e5025073956f9feaf01119ba237434daf
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          System.Threading.dll
          • Path C:\Program Files\OO Software\ShutUp10\System.Threading.dll
          • Size 82KB
          • SHA256 769428cfe7f319abbef27990f0a6bbd3034305271fc7f2a4f409abd15215546f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          clrjit.dll
          • Path C:\Program Files\OO Software\ShutUp10\clrjit.dll
          • Size 1.7MB
          • SHA256 1d13945f7d910f1cc509f7fe2314623f11a11583a528f87f5ba8a5bec185ff15
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          coreclr.dll
          • Path C:\Program Files\OO Software\ShutUp10\coreclr.dll
          • Size 4.8MB
          • SHA256 df38616e2c51cf7a91fbee4ce03f157395375df60c86850f7e552224abd2d7a2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostfxr.dll
          • Path C:\Program Files\OO Software\ShutUp10\hostfxr.dll
          • Size 358KB
          • SHA256 fcc511b4fc48d5741409c3ed66ce76fe574e0a43ac1b2ba955b0f161e4210fac
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hostpolicy.dll
          • Path C:\Program Files\OO Software\ShutUp10\hostpolicy.dll
          • Size 398KB
          • SHA256 192127180f8627a2855aacb0580e4c7c01ef8d9d6f69b3c6c17c06e6ec1acf0c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          log4net.dll
          • Path C:\Program Files\OO Software\ShutUp10\log4net.dll
          • Size 302KB
          • SHA256 fa65f44f848a12766a0820cdea57c071487fa440c05445762416a9a930de856f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          netstandard.dll
          • Path C:\Program Files\OO Software\ShutUp10\netstandard.dll
          • Size 98KB
          • SHA256 ff53c9deb3d087df8090cea3379280becb6b2830546164d52bc55a6ee5d3159c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          oosu10sv.deps.json
          • Path C:\Program Files\OO Software\ShutUp10\oosu10sv.deps.json
          • Size 86KB
          • SHA256 ed640526ea986269fb8b4a5f4ef966a4667e36e3212406218e55e116f302a43c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          oosu10sv.dll
          • Path C:\Program Files\OO Software\ShutUp10\oosu10sv.dll
          • Size 131KB
          • SHA256 51f24d2e23346bd25f4d14b4bc61cd87199f434a6414ef1e88f4a9f3ecd587f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          oosu10sv.exe
          • Path C:\Program Files\OO Software\ShutUp10\oosu10sv.exe
          • Size 161KB
          • SHA256 8b261208dc349127255e208dcf6b4999fe3b4273a8b96570505641678944c934
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          oosu10sv.runtimeconfig.json
          • Path C:\Program Files\OO Software\ShutUp10\oosu10sv.runtimeconfig.json
          • Size 526B
          • SHA256 c2e0b2be79bfe9627acd87ac7112c7b155f519d6768a11d8d0912ad283f2fe3e
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          RegistryChanges.log
          • Path C:\ProgramData\OO Software\OO ShutUp10\Logs\RegistryChanges.log
          • Size 5KB
          • SHA256 533ea8a10c2a41fe2516ac875cfc75ce2d43ea4372fc0ad61b10500157db364c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          8EC9B1D0ABBD7F98B401D425828828CE_FEF18FC28E312420B7BBAE049776B27D
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_FEF18FC28E312420B7BBAE049776B27D
          • Size 727B
          • SHA256 39d89b60a2bdb58e9835f5df3b66647bf7136c559b8351132f75d9f7d5a30639
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 727B
          • SHA256 a582eb9a0a0d65bb0b4175d1e60ea1b2648d9783657f0124796de7b89939efa8
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          8EC9B1D0ABBD7F98B401D425828828CE_FEF18FC28E312420B7BBAE049776B27D
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_FEF18FC28E312420B7BBAE049776B27D
          • Size 404B
          • SHA256 f07114a6ed0c4fdbd799b066ca3a306c96e48a02adf098a398f04c1f1823830a
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
          • Size 412B
          • SHA256 e730b644ee1007bdc575ef3a0a5bcf27aa0043677895cd087ce961b9ac1e1a93
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          OOSU10PE.cfg
          • Path C:\Users\Admin\AppData\Local\OO Software\OO ShutUp10\OOSU10PE.cfg
          • Size 17KB
          • SHA256 388a5d24691685e9459dc7987353069d747e279dc91839d483a45e5a9cad819a
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          OOSU10PE.cfg
          • Path C:\Users\Admin\AppData\Local\OO Software\OO ShutUp10\OOSU10PE.cfg
          • Size 1KB
          • SHA256 0578e987ab6bbeec457e1bf8bfd5163c716cd13774c8688c492dd67b56b22ee1
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          OOSU10PE.cfg~RFe5a8d5d.TMP
          • Path C:\Users\Admin\AppData\Local\OO Software\OO ShutUp10\OOSU10PE.cfg~RFe5a8d5d.TMP
          • Size 1KB
          • SHA256 4c60c5976eb7bc6766c33ed5d17676fba1d85defe9904c4ce677e024f77c6780
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          MSI9a186.LOG
          • Path C:\Users\Admin\AppData\Local\Temp\MSI9a186.LOG
          • Size 86KB
          • SHA256 429a40e55d0c1b2d51d800e29f339ae76f689db9757e07e066ad8c47a25ddb67
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIE073.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIE073.tmp
          • Size 132KB
          • SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI4604.tmp
          • Path C:\Windows\Installer\MSI4604.tmp
          • Size 234KB
          • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 5808637faa1cdf1e416d32097153c23ed44e1f17dc11ac59eaea97319f711968
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {78b48cab-e719-4eaa-b874-a07524474258}_OnDiskSnapshotProp
          • Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{78b48cab-e719-4eaa-b874-a07524474258}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 1433d7a25c23a4d0f85c25edfa66f20c5c911ffb5c93472b16ac00cfc2f42b66
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download