7299266a1b444ebb1bbb00870c84ad6a7c0facfb91ad8bec7ffbd5db9effca09

Analysis

max time kernel
108s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 08:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7299266a1b444ebb1bbb00870c84ad6a7c0facfb91ad8bec7ffbd5db9effca09.exe
Size

221KB
MD5

4c461e1277eb548f02830c9c89413ca0
SHA1

42532ea562ef4caa24f8fc46bb79427471640717
SHA256

7299266a1b444ebb1bbb00870c84ad6a7c0facfb91ad8bec7ffbd5db9effca09
SHA512

49f56c2b93885fa686151fecebb4ed789e7dd126bbe9e03d470043356010b3dbe78504d78aadfbbe7065b4f8beb0606bbfe3a518ce2502372cd00e43aba84392
SSDEEP

3072:B4CgWgTsDAJJRjOV2/pwb5ryT5tlDhB2IFTLFZhh2D+0caj3kyRAC6f94FtRFdaY:B4Cg3JJF35tlDhB2Cn9oz6fYtRFV

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
900	nswitkh.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\zgooxfa.dll	nswitkh.exe
File created	C:\PROGRA~3\Mozilla\nswitkh.exe	7299266a1b444ebb1bbb00870c84ad6a7c0facfb91ad8bec7ffbd5db9effca09.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1060	7299266a1b444ebb1bbb00870c84ad6a7c0facfb91ad8bec7ffbd5db9effca09.exe
900	nswitkh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 900	1904	taskeng.exe	28
PID 1904 wrote to memory of 900	1904	taskeng.exe	28
PID 1904 wrote to memory of 900	1904	taskeng.exe	28
PID 1904 wrote to memory of 900	1904	taskeng.exe	28

C:\Users\Admin\AppData\Local\Temp\7299266a1b444ebb1bbb00870c84ad6a7c0facfb91ad8bec7ffbd5db9effca09.exe
"C:\Users\Admin\AppData\Local\Temp\7299266a1b444ebb1bbb00870c84ad6a7c0facfb91ad8bec7ffbd5db9effca09.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:1060

C:\Windows\system32\taskeng.exe
taskeng.exe {80335930-38A0-4488-A025-53E09E70A744} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\PROGRA~3\Mozilla\nswitkh.exe
  C:\PROGRA~3\Mozilla\nswitkh.exe -vhgoixm
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
221KB

MD5
ef118c598e5a7828983e745d75622b44

SHA1
caed5fbe4832af119dc43d8a7fe64b214ccaa701

SHA256
682ad2789b1b39a525f48733c64a1e3da0601bd4578bbe2685a28a8371fe1414

SHA512
4d8204484183330de327b5eae4405040b281b6a4bdb74cc822066b7755d65e3967c1206abae14ee6e7d76017fbdce02191c79894b23682acbddda585c9f82eed

Download Submit
C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
221KB

MD5
ef118c598e5a7828983e745d75622b44

SHA1
caed5fbe4832af119dc43d8a7fe64b214ccaa701

SHA256
682ad2789b1b39a525f48733c64a1e3da0601bd4578bbe2685a28a8371fe1414

SHA512
4d8204484183330de327b5eae4405040b281b6a4bdb74cc822066b7755d65e3967c1206abae14ee6e7d76017fbdce02191c79894b23682acbddda585c9f82eed

Download Submit
memory/900-60-0x0000000000000000-mapping.dmp

Download
memory/900-63-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/900-64-0x00000000008C0000-0x000000000091B000-memory.dmp

Filesize
364KB

Download
memory/900-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1060-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1060-56-0x0000000000300000-0x000000000035B000-memory.dmp

Filesize
364KB

Download
memory/1060-55-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1060-57-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1060-58-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download