9979c649036650bf639fcb19fe28272d42a4882240ca18d608a107afaf06389b

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9979c649036650bf639fcb19fe28272d42a4882240ca18d608a107afaf06389b.exe
Size

131KB
MD5

4f7a290cc29d5e7e0a32cef602497320
SHA1

037aeadbb39137ea260398a90caff15aed67ddb5
SHA256

9979c649036650bf639fcb19fe28272d42a4882240ca18d608a107afaf06389b
SHA512

80c3b668ec237caf5f8a4434d621b0dbb18649d953c34ce8fb06fc48d7b2f846a51c6fa71f9b09aebdb64e3108df0fd4de0066eac56157ac5c1e6477819f40f0
SSDEEP

3072:4CRg3fScL7qmJOXRlU30A7G1mcJ7oygOJdhyjbBv0sBZa0BX:KqcK2wL674ZojOvEtvTZaWX

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1156	nswitkh.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\nswitkh.exe	9979c649036650bf639fcb19fe28272d42a4882240ca18d608a107afaf06389b.exe
File created	C:\PROGRA~3\Mozilla\zgooxfa.dll	nswitkh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1156	940	taskeng.exe	29
PID 940 wrote to memory of 1156	940	taskeng.exe	29
PID 940 wrote to memory of 1156	940	taskeng.exe	29
PID 940 wrote to memory of 1156	940	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\9979c649036650bf639fcb19fe28272d42a4882240ca18d608a107afaf06389b.exe
"C:\Users\Admin\AppData\Local\Temp\9979c649036650bf639fcb19fe28272d42a4882240ca18d608a107afaf06389b.exe"
1⤵
- Drops file in Program Files directory
PID:1932

C:\Windows\system32\taskeng.exe
taskeng.exe {4D98563A-383D-46CB-BC54-F1A2ED968A47} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\PROGRA~3\Mozilla\nswitkh.exe
  C:\PROGRA~3\Mozilla\nswitkh.exe -vhgoixm
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
131KB

MD5
2daf9f3ec75dfba28ba41783c00557d4

SHA1
28a0531f55c5d6c432c6931cf67c8b566ce1d155

SHA256
6f5f58a81fab085956eb9bac6f9e4abbdbc017688d26c46cdf5fb8fb5cc1c80f

SHA512
5c4d93d7caa02b97f4d9f5a5b3e1ab02c904d9dcdb082ab341ece22658508b8b8a6620e613fcf8051a59a6ae3592a24cb6f610deb59239ff3040ec208331ddef

Download Submit
C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
131KB

MD5
2daf9f3ec75dfba28ba41783c00557d4

SHA1
28a0531f55c5d6c432c6931cf67c8b566ce1d155

SHA256
6f5f58a81fab085956eb9bac6f9e4abbdbc017688d26c46cdf5fb8fb5cc1c80f

SHA512
5c4d93d7caa02b97f4d9f5a5b3e1ab02c904d9dcdb082ab341ece22658508b8b8a6620e613fcf8051a59a6ae3592a24cb6f610deb59239ff3040ec208331ddef

Download Submit
memory/1156-62-0x0000000000000000-mapping.dmp

Download
memory/1932-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1932-55-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download
memory/1932-56-0x0000000000320000-0x000000000037B000-memory.dmp

Filesize
364KB

Download