f213f3aa9006bf740ab8e759521bf0351ebf156ceed5a0aab8f6b99560572924

Analysis

max time kernel
62s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19-10-2022 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f213f3aa9006bf740ab8e759521bf0351ebf156ceed5a0aab8f6b99560572924.exe
Size

283KB
MD5

a12472410ae2a0621f29428b7f6c5160
SHA1

e52ec1025e940d74bb82f6a81e4711892d958beb
SHA256

f213f3aa9006bf740ab8e759521bf0351ebf156ceed5a0aab8f6b99560572924
SHA512

9d5f14284ab0e7917dca0f4aabe7f6ea4adab6a2f2bb3e1fa369f261ee009dea0b6ecc264aed7061ac1542162ef5215728f713ca6111ddd5dd77a89a893b0279
SSDEEP

6144:E5+YVdttGOVfE3dhS0TF+3CTj1PCmjxypE4w330mhv9kKrepex0mC:EjnttTVfShSUF+Ejp1yi30y+KqA0mC

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1508	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	f213f3aa9006bf740ab8e759521bf0351ebf156ceed5a0aab8f6b99560572924.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\f213f3aa9006bf740ab8e759521bf0351ebf156ceed5a0aab8f6b99560572924.exe
"C:\Users\Admin\AppData\Local\Temp\f213f3aa9006bf740ab8e759521bf0351ebf156ceed5a0aab8f6b99560572924.exe"
1⤵
- Drops file in Program Files directory
PID:4780

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
283KB

MD5
34e2731e4ff6efc6dd168f8e13651c20

SHA1
541bc4dfef4e39f500d02d03dee307868943f6c8

SHA256
c2cb5713d2597c75440ff2a8d383c70f7433fd1d727b75a7959193cd38380d14

SHA512
1ea4865fd06fc9471fe2fefaa34d02e0a2b00b6f5dda192fd2ead0c934b010a8aec9a0632af4f9cacf6fd425860705d88046088a29b83ad80dbfd64a16fefc56

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
283KB

MD5
34e2731e4ff6efc6dd168f8e13651c20

SHA1
541bc4dfef4e39f500d02d03dee307868943f6c8

SHA256
c2cb5713d2597c75440ff2a8d383c70f7433fd1d727b75a7959193cd38380d14

SHA512
1ea4865fd06fc9471fe2fefaa34d02e0a2b00b6f5dda192fd2ead0c934b010a8aec9a0632af4f9cacf6fd425860705d88046088a29b83ad80dbfd64a16fefc56

Download Submit
memory/1508-140-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1508-141-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1508-144-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4780-132-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4780-133-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4780-136-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/4780-139-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download