2568898d4cd68b9e7854a1c043f8768692d77856497ed6ebb99f634379a1e8b1

Analysis

max time kernel
61s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2568898d4cd68b9e7854a1c043f8768692d77856497ed6ebb99f634379a1e8b1.exe
Size

299KB
MD5

329618972014745b99ad74bab7778070
SHA1

cc3f71e0b6cc513d86e0ec2c9087a7eea218785f
SHA256

2568898d4cd68b9e7854a1c043f8768692d77856497ed6ebb99f634379a1e8b1
SHA512

43dbffe80e7bbcb35d15750e838474edaf1a48b85a5bb3e028188e2e33c5b09900a83aa8fc9ea65c8c76b923e4b87d38f8facdd51bc35e2a961d4d9390325056
SSDEEP

6144:Pb41nDY6RZ+Pl9Mx0BeY6LCMXRdveOqvQ2w9Z5xntrGtccw:P8dZ6Mx0UYRMXDveDQ2+tcw

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
100	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	2568898d4cd68b9e7854a1c043f8768692d77856497ed6ebb99f634379a1e8b1.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\2568898d4cd68b9e7854a1c043f8768692d77856497ed6ebb99f634379a1e8b1.exe
"C:\Users\Admin\AppData\Local\Temp\2568898d4cd68b9e7854a1c043f8768692d77856497ed6ebb99f634379a1e8b1.exe"
1⤵
- Drops file in Program Files directory
PID:4412

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
299KB

MD5
68cb96b49145022aeb63c774addb160d

SHA1
22c107e1242346581238640270dfc5e3f175266d

SHA256
f780f005f20cb1fc2afe227999b015758fce3dfb056523b7b8353fdd29e66881

SHA512
f976161c9febeef5a7f772ec0c8d7091bc75b0eb04e7c0a03e9cd14dfaf30bad81a3534c6cd5bd92cbd42772842c206f3c08c0394f1b1b182450707b7b5f7780

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
299KB

MD5
68cb96b49145022aeb63c774addb160d

SHA1
22c107e1242346581238640270dfc5e3f175266d

SHA256
f780f005f20cb1fc2afe227999b015758fce3dfb056523b7b8353fdd29e66881

SHA512
f976161c9febeef5a7f772ec0c8d7091bc75b0eb04e7c0a03e9cd14dfaf30bad81a3534c6cd5bd92cbd42772842c206f3c08c0394f1b1b182450707b7b5f7780

Download Submit
memory/100-140-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/100-141-0x00000000008E0000-0x000000000093B000-memory.dmp

Filesize
364KB

Download
memory/100-146-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4412-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/4412-133-0x0000000000580000-0x00000000005DB000-memory.dmp

Filesize
364KB

Download