430e08f125641c5fb2086d895a96dffdaf0d254f88314864c01b8053b0b0ae32

Analysis

max time kernel
112s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2022, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

430e08f125641c5fb2086d895a96dffdaf0d254f88314864c01b8053b0b0ae32.exe
Size

225KB
MD5

720ce2c3b001da616a03337c4c627db0
SHA1

8727f7620b14a4fda778cdf0257dc7ff5e35d989
SHA256

430e08f125641c5fb2086d895a96dffdaf0d254f88314864c01b8053b0b0ae32
SHA512

4659245fe5951959771e71a9d6165ee4f044b521d0cf128c0897835c2572deea48a5303f4b9334878c589587af8c4a9b50584a1571cee2eaec5cd977b061ece5
SSDEEP

3072:B4CgWgTsDAJJRjOV2/pwb5ryT5tlDhB2IFTLFZhh2D+0caj3kyRAC6f94FtRFdaR:B4Cg3JJF35tlDhB2Cn9oz6fYtRFHWn

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1876	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	430e08f125641c5fb2086d895a96dffdaf0d254f88314864c01b8053b0b0ae32.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\430e08f125641c5fb2086d895a96dffdaf0d254f88314864c01b8053b0b0ae32.exe
"C:\Users\Admin\AppData\Local\Temp\430e08f125641c5fb2086d895a96dffdaf0d254f88314864c01b8053b0b0ae32.exe"
1⤵
- Drops file in Program Files directory
PID:3608

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
225KB

MD5
85ba4f21c843c838d1f5d4b12932d120

SHA1
3db8aed44b657003a0555b74f1b2706c8c3fe088

SHA256
7f5bf7117a7644d504129a52a1f7bfd1c5ad0ccca17e383c04ed4ce29fe02b7d

SHA512
183206546447cdd019f60849d0b1df4f90221bbf70f4e2ec421405091a8ab18133e1a963f75010b69146038d39cff706428b00d1b72d08b716ec5416b1bbcdd7

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
225KB

MD5
85ba4f21c843c838d1f5d4b12932d120

SHA1
3db8aed44b657003a0555b74f1b2706c8c3fe088

SHA256
7f5bf7117a7644d504129a52a1f7bfd1c5ad0ccca17e383c04ed4ce29fe02b7d

SHA512
183206546447cdd019f60849d0b1df4f90221bbf70f4e2ec421405091a8ab18133e1a963f75010b69146038d39cff706428b00d1b72d08b716ec5416b1bbcdd7

Download Submit
memory/1876-138-0x0000000000C10000-0x0000000000C6B000-memory.dmp

Filesize
364KB

Download
memory/1876-139-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1876-140-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3608-132-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3608-133-0x00000000020A0000-0x00000000020FB000-memory.dmp

Filesize
364KB

Download
memory/3608-134-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3608-137-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download