Overview

overview

10

Static

static

5

2a0fad48d6...43.exe

windows7-x64

10

2a0fad48d6...43.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 15:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2a0fad48d63cd9d501d5bc557d9baa43.exe

  • Size

    512KB

  • MD5

    2a0fad48d63cd9d501d5bc557d9baa43

  • SHA1

    5462a4b6ceca52a1194728c834ce8980ba34cacc

  • SHA256

    016ee8c23a3d5d52af2b649019c42de1893fafebecfcf62482d35ffc5296fbe5

  • SHA512

    9151972931af6b70abff80bfff8b0cade4de9268bf1973ef26ea3d582934b604ba62268c7503f15924d8d864005dc6ee27d98f5e4cd1b3415f26d2f58936e058

  • SSDEEP

    6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6l:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5M

Score
10/10
evasionpersistencespywarestealertrojan

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • AutoIT Executable 8 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 9 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 18 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a0fad48d63cd9d501d5bc557d9baa43.exe
    "C:\Users\Admin\AppData\Local\Temp\2a0fad48d63cd9d501d5bc557d9baa43.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Windows\SysWOW64\ixolfpispx.exe
      ixolfpispx.exe
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Enumerates connected drives
      • Modifies WinLogon
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\SysWOW64\ehahpnbm.exe
        C:\Windows\system32\ehahpnbm.exe
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2580
    • C:\Windows\SysWOW64\kjmhxvrefldbwar.exe
      kjmhxvrefldbwar.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2864
    • C:\Windows\SysWOW64\ehahpnbm.exe
      ehahpnbm.exe
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2684
    • C:\Windows\SysWOW64\tosjojbzioqzq.exe
      tosjojbzioqzq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2976
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2108
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:524

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe
            Filesize

            512KB

            MD5

            de05e3e0313f94a3d7f6477f6e8e730a

            SHA1

            de9723d39e4c1aa852ead08b072f9a3d966c7339

            SHA256

            3a66c3e37a104db9c913461070d879b5ea0341c99d2e04f78716aec4721b505b

            SHA512

            406926fdef59c7f60161d0926d7e649a05b2433c299c740cbcc349f8c20aa405315f0dd2db58aba389eabc86ba5293269cfdaf5a353862f57475b39843e4bf38

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
            Filesize

            20KB

            MD5

            9b5b14e678e40e8fdcc37f2a98863988

            SHA1

            b5e688e3e5edcf2245f2bb6d98a2767e4a8e2c56

            SHA256

            ce35141695002e49dc501e39914c13529cdc5a2f631d1b46bca05ac09cff9dbc

            SHA512

            feb851d80f8be29d66f7bd6f59c899f21237bec84dd2024e403f3c57911c7d2c9b3de7ae9b122f22ee9f70ac8a12b3e1072bd53de8d9a394fee62bd4df4fffb3

            Download Submit

          • C:\Windows\SysWOW64\ehahpnbm.exe
            Filesize

            93KB

            MD5

            257f28bd5bdc2b725434b7ab570814e7

            SHA1

            972446e0f8d210c5d6f42a57a921391a236d564d

            SHA256

            d80f45a5995ba038d69dbe87f7c12827ffa2b53e79beedb0bc6ee91c10a61688

            SHA512

            c27aa91c3c3605941a1a121021c840fc7886cf27d43e9d6b2c371888a276d9dfd39135600a4f933f62dfa3d46cb6e12de6e31b3f8b939676701ff37f8cc61575

            Download Submit

          • C:\Windows\SysWOW64\kjmhxvrefldbwar.exe
            Filesize

            512KB

            MD5

            4a8eaf942bdcd418e670e0f90ca65b15

            SHA1

            4b85e8734c966d03eadd16ac8317bfe3a8c8ad98

            SHA256

            3f6d17fe04738dd690459acb32cb69c989ccdc2c46149eee09a2c0bad8b581a7

            SHA512

            f6858f90a958c119c27e290f72412779ef9ab71a2f64826f2ed4ca433a82c50b85a40edcda3a255f7815d752ad94397ce058bbd273ee2b9c1b92ea016d15a8ba

            Download Submit

          • C:\Windows\mydoc.rtf
            Filesize

            223B

            MD5

            06604e5941c126e2e7be02c5cd9f62ec

            SHA1

            4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

            SHA256

            85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

            SHA512

            803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

            Download Submit

          • \Windows\SysWOW64\ehahpnbm.exe
            Filesize

            512KB

            MD5

            a8fd6f0eb849324ebb3efb1594f63b52

            SHA1

            70e4c2a4a4f2f05ca16d8470d0b6f61eafacca0b

            SHA256

            6c7df7da9e5189161f885095776deda1488f8c6ac701eea40b55f361c3b9184a

            SHA512

            9722f04c44f2c3a30184a24e5f63a33a8fee3a498936e1813692c2ea1d98f87562554adbdf809fd59fd76a9f58a483a6c0aba66f9f60b69ad6eefd01d88b4790

            Download Submit

          • \Windows\SysWOW64\ixolfpispx.exe
            Filesize

            512KB

            MD5

            3a6750a57511ba2330e39d585e9662d0

            SHA1

            ce396314780c28d63016b6406cf05a9b5e86ee3b

            SHA256

            c93f921a54620b81b54aa20e9ff3380a5008d28f1dc75286d2b5fb5ce1f13ac4

            SHA512

            8d23efabef60c1b5ff6314e0b224be3c9fb049915ce94a32d7e3542e599ed9e80115a36a6d979a2b17959484196008bf96dc64214b708d80bd7986bbc21d4bcc

            Download Submit

          • \Windows\SysWOW64\tosjojbzioqzq.exe
            Filesize

            512KB

            MD5

            214bfafd11d3367b1fe60fc2d0f7c715

            SHA1

            219b04b3abd8b3e2f55c1eba4946e158720f1ff2

            SHA256

            0b8833cbe9f2138ef480746caeb4dd95051854da379397e9379672ca47233d2d

            SHA512

            9b51ac5bc5c2a624247dd3c8af9aa0280fbb6475b5e34207dc73b8365cc0e1248624d0dd22b9071f61c901aa3fa399fe2863585cc7660afde3b7d0de4ccf4a1a

            Download Submit

          • memory/2108-45-0x000000002F501000-0x000000002F502000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2108-47-0x000000007182D000-0x0000000071838000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2108-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2108-76-0x000000007182D000-0x0000000071838000-memory.dmp

            Filesize

            44KB

            Download

          • memory/2108-97-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3044-0-0x0000000000400000-0x0000000000496000-memory.dmp

            Filesize

            600KB

            Download