Managed XDR

osk.exe (Expiro) — malware analysis report

File info

Filename
osk.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
File size
634.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
41e4d6b959bad2f86ddad2eb1bd455b0c71e41df
SHA256
ab33b2e8ecfdfc54ba6934cca30b60da1da9d5484f385c5d5ce7bff35560b985
MD5
0504d3822831dacb773a9e4ae70fa41f

Malwares

  • Expiro

Signatures

Persistence

T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key

Privilege Escalation

T1574.011 persistence_services: Modifies Services registry key
T1543.003 persistence_services: Modifies Services registry key
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1497.001 antivm_generic_services: Enumerates services, possibly for anti-virtualization
T1497.001 antisandbox_productid: Obtains Windows ProductID, probably to fingerprint a sandbox
T1562.001 browser_security: Modifies browser security settings
T1497.001 antivm_disk_size: Checks the amount of free disk space
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1574.011 persistence_services: Modifies Services registry key
T1036 system_filename: Created a file named as a common system file
T1027.002 pe_features: Executable file has PE anomalies (may be false positive)
T1497 evasion_diskenum: Sandbox evasion using enumeration of partitions
T1497.001 antivm_queries_computername: Retrieves the computer name
T1480 system_default_lang_id_present: Checks the system language
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Credential Access

T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)
T1552 infostealer_browser: Retrieves personal information from local Internet browsers
T1552 infostealer_ftp: Collects data from local FTP clients
T1503 infostealer_browser: Retrieves personal information from local Internet browsers
T1552 cookie_files: Accesses cookie files
T1555.003 cookie_files: Accesses cookie files

Discovery

T1497.001 antivm_generic_services: Enumerates services, possibly for anti-virtualization
T1497.001 antisandbox_productid: Obtains Windows ProductID, probably to fingerprint a sandbox
T1518.001 antiav_detectservice: Attempts to detect installed antiviruses by a certain service
T1497.001 antivm_disk_size: Checks the amount of free disk space
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1497 evasion_diskenum: Sandbox evasion using enumeration of partitions
T1497.001 antivm_queries_computername: Retrieves the computer name

Collection

T1056.001 infostealer_keylogger: Keylogger (intercepts keystrokes)

Impact

T1489 change_service_config: Stops services via ChangeServiceConfig

Other

yara_rules: Static rules
executes_dropped_exe: Executes dropped exe files
creates_in_windows: Creates files in the Windows directory
expiro_mutexes: Expiro is detected: mutex
creates_exe: Creates executable files in the file system
create_rpc_bindings: Creates RPC connection
has_pdb: This executable file has a PDB path
break_limit_exceeded: Warning: function calls limit has been exceeded
access_recyclebin: Manipulation with recyclebin detected
test_check_service: Starts services
checktokenmembership: Checks user token with CheckTokenMembership call
writes_data: Writes big amount of data to disk
pe_overlay: PE file contains overlay

Related reports