fb5b82efd2a67768b8d0b454ba0090d6efa251831949dd522f0e64e9aaea7b87

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb5b82efd2a67768b8d0b454ba0090d6efa251831949dd522f0e64e9aaea7b87.exe
Size

470KB
MD5

4cf95efe37da0fe5aa01e38d6a498820
SHA1

3a46d731c2544672c02b1296ff66aa96e1611c30
SHA256

fb5b82efd2a67768b8d0b454ba0090d6efa251831949dd522f0e64e9aaea7b87
SHA512

463d98beb4f9814048dae0a97567b65108930c889efb9b89736453b2034fde152685fa0c91aa7e36f4d3c35f1db816df81cfaafb336cdadcf7bde1f6286670a4
SSDEEP

12288:51i/ljo6d94Z2NC+H07HQP4pgIHy0/GqBcL4DGsxv3FAh:51i9Igs57HQPzIXGqy0K2tw

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
208	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	fb5b82efd2a67768b8d0b454ba0090d6efa251831949dd522f0e64e9aaea7b87.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\fb5b82efd2a67768b8d0b454ba0090d6efa251831949dd522f0e64e9aaea7b87.exe
"C:\Users\Admin\AppData\Local\Temp\fb5b82efd2a67768b8d0b454ba0090d6efa251831949dd522f0e64e9aaea7b87.exe"
1⤵
- Drops file in Program Files directory
PID:1756

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
470KB

MD5
be6108fc91f316d8bef9042005e2cfd3

SHA1
a3e34275ba5f26344e62e26af83169fae3b8efab

SHA256
b72cb2ef937857bdaa9190faae4fa4bf7f0b6c6a42a173e4d4791222538f0859

SHA512
6fd2fd4cf0806257c62eb0c7de809bb5e062607878455e742b982cb6119dc8eacfce6dc24c99d9151a65aeb2936e32acb05ecdf2077874d491d8643039a995ed

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
470KB

MD5
be6108fc91f316d8bef9042005e2cfd3

SHA1
a3e34275ba5f26344e62e26af83169fae3b8efab

SHA256
b72cb2ef937857bdaa9190faae4fa4bf7f0b6c6a42a173e4d4791222538f0859

SHA512
6fd2fd4cf0806257c62eb0c7de809bb5e062607878455e742b982cb6119dc8eacfce6dc24c99d9151a65aeb2936e32acb05ecdf2077874d491d8643039a995ed

Download Submit
memory/208-138-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/208-139-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1756-132-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1756-133-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download