cbeceafb0f26ab6bfcc0d21d2171c774ec88841058c86bb972eddc163743143a

Analysis

max time kernel
94s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbeceafb0f26ab6bfcc0d21d2171c774ec88841058c86bb972eddc163743143a.exe
Size

272KB
MD5

6e366e5e11747fb24e72e2047fd00140
SHA1

974e5a896008ec1021f7fdf14de1dd3137fba263
SHA256

cbeceafb0f26ab6bfcc0d21d2171c774ec88841058c86bb972eddc163743143a
SHA512

ce8f05820a2b4d5f1e06661dae11c7adc7c9ba27289aa4d2567ad3afaf286a6f851768e9718efa0e2dc61dc6f0353a998242014100b90131e494d26df0c85642
SSDEEP

6144:MfRuSxFMY2uYmVAvivBHDpr88CtFO4y3vVkzjIfO5Lr:MgSxFMiYmVAviv5Z8nt1UkAI

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4708	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	cbeceafb0f26ab6bfcc0d21d2171c774ec88841058c86bb972eddc163743143a.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\cbeceafb0f26ab6bfcc0d21d2171c774ec88841058c86bb972eddc163743143a.exe
"C:\Users\Admin\AppData\Local\Temp\cbeceafb0f26ab6bfcc0d21d2171c774ec88841058c86bb972eddc163743143a.exe"
1⤵
- Drops file in Program Files directory
PID:1384

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
272KB

MD5
35d81d7bc5e380ec55bb966ee937b5e5

SHA1
bbec3257bad153e45cf9879e22c080cacbe71e7a

SHA256
31a165a947c400b849a6e9c2bddf2c95a3f642e2dd6d52961a2b4f3bce58701c

SHA512
57620cc72f2a70ee121995bcc5db9da12cb98d12c67f72e34b9b96f335f6f8fb97e394f465097adca6363c7c53f97ab186949454bc9bb789612dafd32b1a50b9

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
272KB

MD5
35d81d7bc5e380ec55bb966ee937b5e5

SHA1
bbec3257bad153e45cf9879e22c080cacbe71e7a

SHA256
31a165a947c400b849a6e9c2bddf2c95a3f642e2dd6d52961a2b4f3bce58701c

SHA512
57620cc72f2a70ee121995bcc5db9da12cb98d12c67f72e34b9b96f335f6f8fb97e394f465097adca6363c7c53f97ab186949454bc9bb789612dafd32b1a50b9

Download Submit
memory/1384-132-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1384-133-0x00000000005E0000-0x000000000063B000-memory.dmp

Filesize
364KB

Download
memory/4708-140-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4708-141-0x0000000000D30000-0x0000000000D8B000-memory.dmp

Filesize
364KB

Download
memory/4708-146-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download