ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6

Analysis

max time kernel
88s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6.exe
Size

210KB
MD5

427958b792fc5027afd8d618b3ca64e0
SHA1

e9d0bd4377f374ccc3498277dce1bd295b307573
SHA256

ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6
SHA512

ce2d5d481f727c97f19628a01fea093f2f680ae23ead493afe59e2f73ee605636e15892100a99a19f1e5d0a1f8a6d69cd72084ad8039ff4fc03ef4c56890bb44
SSDEEP

3072:n4CgNgTsDAJJRjOmh4JUABuENeXkm6cANLFZhh2D+0caj3kyRAChmN:n4CgCJJnyyABu+QHANn9ozW

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
544	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6.exe
"C:\Users\Admin\AppData\Local\Temp\ee9edbb39e8b43d053b6dd7f4f7bf7d55fe13380e243dcd4abec5525526124e6.exe"
1⤵
- Drops file in Program Files directory
PID:1140

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
210KB

MD5
0a542f44dacafff27455aa6919237891

SHA1
34ea7f7268977810b5f896261693cd3c4b999f8a

SHA256
d7f38b14ea6d88542389211c77c3a0719f8aa0def89da9c6de251ef66b5a95cc

SHA512
561e2acd6901113a8f3f2d24b907ad8d4d07216e925b17b271c1385bc3ab9e82a96515ed550afae967cd7a1a6a06311b9290ddcfe1a1c57b514c832757384746

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
210KB

MD5
0a542f44dacafff27455aa6919237891

SHA1
34ea7f7268977810b5f896261693cd3c4b999f8a

SHA256
d7f38b14ea6d88542389211c77c3a0719f8aa0def89da9c6de251ef66b5a95cc

SHA512
561e2acd6901113a8f3f2d24b907ad8d4d07216e925b17b271c1385bc3ab9e82a96515ed550afae967cd7a1a6a06311b9290ddcfe1a1c57b514c832757384746

Download Submit
memory/544-137-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/544-138-0x0000000000C10000-0x0000000000C6B000-memory.dmp

Filesize
364KB

Download
memory/544-139-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1140-132-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1140-133-0x00000000021D0000-0x000000000222B000-memory.dmp

Filesize
364KB

Download
memory/1140-134-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download