e78879066a93c79047d49f8f21fbb61a3e8155ad1cfb6b02335a1a79f19c235d

Analysis

max time kernel
59s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e78879066a93c79047d49f8f21fbb61a3e8155ad1cfb6b02335a1a79f19c235d.exe
Size

154KB
MD5

41f8f2628b425aa933c86fab1a0cc7aa
SHA1

37aa5de2b9fc231b845ca5fe561cf36a2d548bd3
SHA256

e78879066a93c79047d49f8f21fbb61a3e8155ad1cfb6b02335a1a79f19c235d
SHA512

266c337e03263d2237b7092b5ee303d85d7716ab4a2e0d0c7e02b2b36b76f85bca419177fb159d08b73103349e8bb74b4260c40ed8c6eb11d18540c393864008
SSDEEP

3072:4CRg3fScL7qmJOXRlU30A7G1mcJ7oygOJdhyjbBv0sBZa0Bv7Ze1l2+:KqcK2wL674ZojOvEtvTZaWv7414+

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1212	nswitkh.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\nswitkh.exe	e78879066a93c79047d49f8f21fbb61a3e8155ad1cfb6b02335a1a79f19c235d.exe
File created	C:\PROGRA~3\Mozilla\zgooxfa.dll	nswitkh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 1212	1752	taskeng.exe	29
PID 1752 wrote to memory of 1212	1752	taskeng.exe	29
PID 1752 wrote to memory of 1212	1752	taskeng.exe	29
PID 1752 wrote to memory of 1212	1752	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\e78879066a93c79047d49f8f21fbb61a3e8155ad1cfb6b02335a1a79f19c235d.exe
"C:\Users\Admin\AppData\Local\Temp\e78879066a93c79047d49f8f21fbb61a3e8155ad1cfb6b02335a1a79f19c235d.exe"
1⤵
- Drops file in Program Files directory
PID:980

C:\Windows\system32\taskeng.exe
taskeng.exe {15CD5328-37FC-4AD2-9F4A-B007E8C8A588} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1752
- C:\PROGRA~3\Mozilla\nswitkh.exe
  C:\PROGRA~3\Mozilla\nswitkh.exe -vhgoixm
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
154KB

MD5
c3dfb0294380aaf84a83a67b249eab48

SHA1
46a3bc4a3417ff7ab426508123049892822f5425

SHA256
6e14a9f5df91009c66161696b64414384f8a0e3a28b7e201f1e99b8dd4af22de

SHA512
239fbd850f18efd534eccaa5008debe310cc5ee29ab0b5688bac9b1d456b7bc0c3beaccdced07ed408e8cf4d8aef077223771f4b3c5f19b8d0830ceb50871c31

Download Submit
C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
154KB

MD5
c3dfb0294380aaf84a83a67b249eab48

SHA1
46a3bc4a3417ff7ab426508123049892822f5425

SHA256
6e14a9f5df91009c66161696b64414384f8a0e3a28b7e201f1e99b8dd4af22de

SHA512
239fbd850f18efd534eccaa5008debe310cc5ee29ab0b5688bac9b1d456b7bc0c3beaccdced07ed408e8cf4d8aef077223771f4b3c5f19b8d0830ceb50871c31

Download Submit
memory/980-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/980-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/980-56-0x0000000000320000-0x000000000037B000-memory.dmp

Filesize
364KB

Download
memory/1212-65-0x0000000000630000-0x000000000068B000-memory.dmp

Filesize
364KB

Download