ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6

Analysis

max time kernel
41s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6.exe
Size

210KB
MD5

427958b792fc5027afd8d618b3ca64e0
SHA1

e9d0bd4377f374ccc3498277dce1bd295b307573
SHA256

ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6
SHA512

ce2d5d481f727c97f19628a01fea093f2f680ae23ead493afe59e2f73ee605636e15892100a99a19f1e5d0a1f8a6d69cd72084ad8039ff4fc03ef4c56890bb44
SSDEEP

3072:n4CgNgTsDAJJRjOmh4JUABuENeXkm6cANLFZhh2D+0caj3kyRAChmN:n4CgCJJnyyABu+QHANn9ozW

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1248	sgfgrig.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\sgfgrig.exe	ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6.exe
File created	C:\PROGRA~3\Mozilla\ogcwmgm.dll	sgfgrig.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1412	ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6.exe
1248	sgfgrig.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1248	956	taskeng.exe	28
PID 956 wrote to memory of 1248	956	taskeng.exe	28
PID 956 wrote to memory of 1248	956	taskeng.exe	28
PID 956 wrote to memory of 1248	956	taskeng.exe	28

C:\Users\Admin\AppData\Local\Temp\ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6.exe
"C:\Users\Admin\AppData\Local\Temp\ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:1412

C:\Windows\system32\taskeng.exe
taskeng.exe {641DB269-0BA9-4740-979A-4DDF0B4220C1} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\PROGRA~3\Mozilla\sgfgrig.exe
  C:\PROGRA~3\Mozilla\sgfgrig.exe -smuvcxh
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:1248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\sgfgrig.exe

Filesize
210KB

MD5
c2d2d526f7cf4dad798420a3f23d3d5f

SHA1
f4885d78ba18cf27cf7b2d41eff7552076f79eca

SHA256
e5010c94a626556eea56f01c65cad1506edcfb3c1fc249dc8547f8cabb3ee3bf

SHA512
32358d82d369016514642b8eba793cee0f9d7f17599854b5a289eeb1e4ff3835327b94431504512a2bf0bbd9494d6303918fad468f2856e9962353f13b803501

Download Submit
C:\PROGRA~3\Mozilla\sgfgrig.exe

Filesize
210KB

MD5
c2d2d526f7cf4dad798420a3f23d3d5f

SHA1
f4885d78ba18cf27cf7b2d41eff7552076f79eca

SHA256
e5010c94a626556eea56f01c65cad1506edcfb3c1fc249dc8547f8cabb3ee3bf

SHA512
32358d82d369016514642b8eba793cee0f9d7f17599854b5a289eeb1e4ff3835327b94431504512a2bf0bbd9494d6303918fad468f2856e9962353f13b803501

Download Submit
memory/1248-63-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1248-64-0x00000000003A0000-0x00000000003FB000-memory.dmp

Filesize
364KB

Download
memory/1248-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1412-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1412-55-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1412-56-0x0000000000460000-0x00000000004BB000-memory.dmp

Filesize
364KB

Download
memory/1412-57-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1412-58-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download