a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a

Analysis

max time kernel
150s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/05/2024, 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe
Size

72KB
MD5

158f1158370a95e37884c22cce2ba98a
SHA1

2ae622a78bc07746b2c2fc7d78699e83d6fb0846
SHA256

a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a
SHA512

9e2240e8a69779b73a2b8361c5988a023b5f3a385973388bdf664b0c5dddadc0e8b8a7c18bfce71a9bcbea9d27d29f05ffc79e49c1da892f7b9e02c1196d4336
SSDEEP

1536:xyGioEFhlmSUO4tss7GwZyC2LcdtdoqDbAPfMzETC7fYJJgISHgzPZLH:p8VmSB4tss7GwZyC1NZO0zH2gBoZLH

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	adfoted-ocur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	adfoted-ocur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	adfoted-ocur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	adfoted-ocur.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\IsInstalled = "1"	adfoted-ocur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\StubPath = "C:\\Windows\\system32\\uflaxooc-doot.exe"	adfoted-ocur.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}	adfoted-ocur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a"	adfoted-ocur.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	adfoted-ocur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a"	adfoted-ocur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ibbodeah-mom.exe"	adfoted-ocur.exe

Executes dropped EXE 2 IoCs

pid	Process
1676	adfoted-ocur.exe
2864	adfoted-ocur.exe

Loads dropped DLL 3 IoCs

pid	Process
2348	a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe
2348	a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe
1676	adfoted-ocur.exe

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "25600"	adfoted-ocur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "25600"	adfoted-ocur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "25600"	adfoted-ocur.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "25600"	adfoted-ocur.exe

Modifies WinLogon 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}	adfoted-ocur.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	adfoted-ocur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a"	adfoted-ocur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\unfoanook-oudex.dll"	adfoted-ocur.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup"	adfoted-ocur.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\adfoted-ocur.exe	a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe
File opened for modification	C:\Windows\SysWOW64\ibbodeah-mom.exe	adfoted-ocur.exe
File opened for modification	C:\Windows\SysWOW64\uflaxooc-doot.exe	adfoted-ocur.exe
File created	C:\Windows\SysWOW64\unfoanook-oudex.dll	adfoted-ocur.exe
File opened for modification	C:\Windows\SysWOW64\adfoted-ocur.exe	adfoted-ocur.exe
File opened for modification	C:\Windows\SysWOW64\adfoted-ocur.exe	a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe
File created	C:\Windows\SysWOW64\ibbodeah-mom.exe	adfoted-ocur.exe
File created	C:\Windows\SysWOW64\uflaxooc-doot.exe	adfoted-ocur.exe
File opened for modification	C:\Windows\SysWOW64\unfoanook-oudex.dll	adfoted-ocur.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
2864	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe
1676	adfoted-ocur.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1676	adfoted-ocur.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1676	2348	a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe	28
PID 2348 wrote to memory of 1676	2348	a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe	28
PID 2348 wrote to memory of 1676	2348	a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe	28
PID 2348 wrote to memory of 1676	2348	a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe	28
PID 1676 wrote to memory of 2864	1676	adfoted-ocur.exe	29
PID 1676 wrote to memory of 2864	1676	adfoted-ocur.exe	29
PID 1676 wrote to memory of 2864	1676	adfoted-ocur.exe	29
PID 1676 wrote to memory of 2864	1676	adfoted-ocur.exe	29
PID 1676 wrote to memory of 424	1676	adfoted-ocur.exe	5
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21
PID 1676 wrote to memory of 1268	1676	adfoted-ocur.exe	21

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:424

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe
  "C:\Users\Admin\AppData\Local\Temp\a289f0e4126f0ba5f419cbf3d70248806e9dfd11590f87b07e466b53ccd4c88a.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\adfoted-ocur.exe
    "C:\Windows\SysWOW64\adfoted-ocur.exe"
    3⤵
    - Windows security bypass
    - Modifies Installed Components in the registry
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Modifies WinLogon
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Windows\SysWOW64\adfoted-ocur.exe
      --k33p
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ibbodeah-mom.exe

Filesize
73KB

MD5
8133f94c7be28fbf67373e2594e9b178

SHA1
f5cedda829a68761fa03ec6f9574ff1f5e11535c

SHA256
fdebff384893efed3dac90c4e1ca7b923b60fdca01e26bd47d2bbd0532818384

SHA512
f6c9a5fc9cc4c2bb84c470fff8163c16a6a99aa8cccc9c0eb061f0b2cd68c456485466dd021a1bb20452fa67e191cc01b9792ab5a1cf2189b8341bca5729a844

Download Submit
C:\Windows\SysWOW64\uflaxooc-doot.exe

Filesize
72KB

MD5
a3e987d06baadeb6536f5ed6ceec6acb

SHA1
e2c611b06f6b48e5e4bdeb90238971ecc4118dc3

SHA256
d1736454dcc3620e908bcbb285697ed36d01b20d96487c72025ba677035ded82

SHA512
8a67d1caf0ab87967e6da3049257708aad2d324332e25615af1bfd37e15de3fd4d35b760d1a0fa54592b6ccfe17c4435aa231a971993e2c80ddeb6525be7f567

Download Submit
C:\Windows\SysWOW64\unfoanook-oudex.dll

Filesize
5KB

MD5
f37b21c00fd81bd93c89ce741a88f183

SHA1
b2796500597c68e2f5638e1101b46eaf32676c1c

SHA256
76cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0

SHA512
252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4

Download Submit
\Windows\SysWOW64\adfoted-ocur.exe

Filesize
70KB

MD5
6bb5d389376b7eb38f51a085a31ac70c

SHA1
943aa583fdaccca793e4ad5e557bf04448f1bdbb

SHA256
0f99552fb0870414a14987086d55f380edf02ffc1d52cc239436866ed31f45ff

SHA512
e52f512cd1205250e035cb63b5b41dd51ae1dc4b4cfbd4232c2c618c8f5ae215a6bae9263b43c731b55775b15f4012f3ee4491b4ec78060eed22bdeb4f608058

Download Submit
memory/1676-50-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2348-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2864-51-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download