442fb4b398db3dcd79b0f3bd78cef56685dd2e5add37b4edab5d4762912f964c

Analysis

max time kernel
84s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

442fb4b398db3dcd79b0f3bd78cef56685dd2e5add37b4edab5d4762912f964c.exe
Size

161KB
MD5

80b1967d1e4da878088b7cbb4158bf20
SHA1

f68ec4ed09d2971908fbc6e88af49bf35348f161
SHA256

442fb4b398db3dcd79b0f3bd78cef56685dd2e5add37b4edab5d4762912f964c
SHA512

e63626f5a58ee58055048e1af6c56f6223ba01f126399ab2766e6b66ba7b2fb6e413218ec25f4d3971698f388a6de1569760bdc69d431680a462d8f403efaeae
SSDEEP

3072:CDUp8yetaIBOvnMqllHQmkKtaY/JB/KMu0oS2rOaQn3OOXluZLq290LAP/0y+ntS:CDJVazMKV31FdaQvXluxqU+A/0y+ntS

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3932	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	442fb4b398db3dcd79b0f3bd78cef56685dd2e5add37b4edab5d4762912f964c.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\442fb4b398db3dcd79b0f3bd78cef56685dd2e5add37b4edab5d4762912f964c.exe
"C:\Users\Admin\AppData\Local\Temp\442fb4b398db3dcd79b0f3bd78cef56685dd2e5add37b4edab5d4762912f964c.exe"
1⤵
- Drops file in Program Files directory
PID:3536

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
161KB

MD5
eb8b6a616ea9459e993671b400c0f551

SHA1
705d727cee4dcc10784d16e94a776fdd450b306b

SHA256
b7972c10f0e8611d3f9778955b1dfbcc85d047edf834b62ff3110832aa3e9505

SHA512
7b9a8a0177b548f91f0a7e4d14b72171b8859699342f483b6732f8ee2ca32f579356c4fcdf63bc8e8946fc8b54a2a6d5ac8882705a7ccfb765e82ff81f72efc7

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
161KB

MD5
eb8b6a616ea9459e993671b400c0f551

SHA1
705d727cee4dcc10784d16e94a776fdd450b306b

SHA256
b7972c10f0e8611d3f9778955b1dfbcc85d047edf834b62ff3110832aa3e9505

SHA512
7b9a8a0177b548f91f0a7e4d14b72171b8859699342f483b6732f8ee2ca32f579356c4fcdf63bc8e8946fc8b54a2a6d5ac8882705a7ccfb765e82ff81f72efc7

Download Submit
memory/3536-132-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3536-133-0x0000000000A00000-0x0000000000A5B000-memory.dmp

Filesize
364KB

Download
memory/3932-140-0x0000000000560000-0x00000000005BB000-memory.dmp

Filesize
364KB

Download
memory/3932-145-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download