2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8

Analysis

max time kernel
141s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8.exe
Size

213KB
MD5

019b1c16d2d9003f04c2d7efa9917059
SHA1

dda80eda77dd345219bab319d4766602f9335699
SHA256

2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8
SHA512

e393e0f7d3a26a1013b873d41193e27b06e85565e6a8d613da854ab56dfb41df63eefa2e85c61fd933f7702728169e1f6650ec92c0ad2332dfc8c7f78780a247
SSDEEP

6144:p44b7czAEYdlyp6rswaDqKgL08qvFsRc2:m4fiQdlnoxgYlvy1

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
3984	ohfxkha.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\ohfxkha.exe	2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8.exe
File created	C:\PROGRA~3\Mozilla\hdgkqaj.dll	ohfxkha.exe

C:\Users\Admin\AppData\Local\Temp\2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8.exe
"C:\Users\Admin\AppData\Local\Temp\2ddaaf5fad0dd05ce2e7fa24f22c4ec92659253de3db2a3c0abda2d8a21912a8.exe"
1⤵
- Drops file in Program Files directory
PID:2036

C:\PROGRA~3\Mozilla\ohfxkha.exe
C:\PROGRA~3\Mozilla\ohfxkha.exe -jmpzska
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\ohfxkha.exe

Filesize
213KB

MD5
dedaa3eb3116348fb2ca0742d418a0b7

SHA1
6e090793f7f18b28f1dc2905dda1d51bd9b0a019

SHA256
139cbcca2e6bc93b256f384dd5834f9f82c60f8408d811a2fd3f910ba8ad224a

SHA512
0e3f33cb14aa5cba39c465f05bcec6f1d55920e6a3d56bf74ba5d702dc606c894c7c197da3730a59497d030fecdc2530fc379df6f6d75899148fb361e78aa408

Download Submit
memory/2036-0-0x00000000020C0000-0x000000000211B000-memory.dmp

Filesize
364KB

Download
memory/2036-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2036-5-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2036-8-0x00000000020C0000-0x000000000211B000-memory.dmp

Filesize
364KB

Download
memory/3984-7-0x0000000000D60000-0x0000000000DBB000-memory.dmp

Filesize
364KB

Download
memory/3984-9-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3984-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download