2dc95bb429e4735ee1217ef8eae79c24fd540080ddc4cb0d87d28ddebcaf9752

Analysis

max time kernel
50s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dc95bb429e4735ee1217ef8eae79c24fd540080ddc4cb0d87d28ddebcaf9752.exe
Size

235KB
MD5

496b93e12d9a0e0b7528f295cffe5f50
SHA1

3f4db8fbe91559aaddcc569dd7d0717196aeb565
SHA256

2dc95bb429e4735ee1217ef8eae79c24fd540080ddc4cb0d87d28ddebcaf9752
SHA512

c275f932e1281799e07e90afa9a4f584d1246fa54f9c6863b6e01391012ab9f45caa281cad87d472b724b53e5be64b4d71fc069c323318b5ab62e27ad1e7aefa
SSDEEP

3072:cO56oJRQMumlCm3dqQiF7xAF/yPRFrPvE5JuiBmIX9pcL5C2:cOAoXQMumNFWO/crkHuiga8L5P

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2032	sgfgrig.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\sgfgrig.exe	2dc95bb429e4735ee1217ef8eae79c24fd540080ddc4cb0d87d28ddebcaf9752.exe
File created	C:\PROGRA~3\Mozilla\ogcwmgm.dll	sgfgrig.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
368	2dc95bb429e4735ee1217ef8eae79c24fd540080ddc4cb0d87d28ddebcaf9752.exe
2032	sgfgrig.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2032	832	taskeng.exe	28
PID 832 wrote to memory of 2032	832	taskeng.exe	28
PID 832 wrote to memory of 2032	832	taskeng.exe	28
PID 832 wrote to memory of 2032	832	taskeng.exe	28

C:\Users\Admin\AppData\Local\Temp\2dc95bb429e4735ee1217ef8eae79c24fd540080ddc4cb0d87d28ddebcaf9752.exe
"C:\Users\Admin\AppData\Local\Temp\2dc95bb429e4735ee1217ef8eae79c24fd540080ddc4cb0d87d28ddebcaf9752.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:368

C:\Windows\system32\taskeng.exe
taskeng.exe {96549507-C4E3-4EC1-9E9E-F232812DCB62} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\PROGRA~3\Mozilla\sgfgrig.exe
  C:\PROGRA~3\Mozilla\sgfgrig.exe -smuvcxh
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\sgfgrig.exe

Filesize
235KB

MD5
ef9863bf16f4b2f50ac1fa7366387367

SHA1
3c09b60696f6892fb15a09749117b2be07bf0e95

SHA256
59fb5f45d0ed8c22974caec9e51944baa6fc278e267d1b5c0faebd5660c4f469

SHA512
049809313095ba30c141c81458b0bcaca719213f1b68c64746aeb13fab2e6b4fcd7aebfe4d07069475825e6e66cd1fafafa14745d22a68628b302cede9976185

Download Submit
C:\PROGRA~3\Mozilla\sgfgrig.exe

Filesize
235KB

MD5
ef9863bf16f4b2f50ac1fa7366387367

SHA1
3c09b60696f6892fb15a09749117b2be07bf0e95

SHA256
59fb5f45d0ed8c22974caec9e51944baa6fc278e267d1b5c0faebd5660c4f469

SHA512
049809313095ba30c141c81458b0bcaca719213f1b68c64746aeb13fab2e6b4fcd7aebfe4d07069475825e6e66cd1fafafa14745d22a68628b302cede9976185

Download Submit
memory/368-54-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download
memory/368-55-0x0000000001B80000-0x0000000001BDB000-memory.dmp

Filesize
364KB

Download
memory/368-56-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/368-57-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/368-58-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2032-63-0x00000000002E0000-0x000000000033B000-memory.dmp

Filesize
364KB

Download
memory/2032-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2032-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download