311aed728284c35387049456677fc942df73dece364f5429ea4d6a93029f373c

Analysis

max time kernel
114s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 09:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

311aed728284c35387049456677fc942df73dece364f5429ea4d6a93029f373c.exe
Size

140KB
MD5

5525ee4fbe3388d241adfa8ac6fadcf0
SHA1

3d3c567e97d8cef9eb7ea3159f45374fb02d8491
SHA256

311aed728284c35387049456677fc942df73dece364f5429ea4d6a93029f373c
SHA512

2a87b105cb1d9f964ef0b515a382317841a4b60d4c30b6c119b645687216b8292193d8f3e5d941c9ab846f66511c4156c2a4464b34dc262381243b1b78e8522d
SSDEEP

3072:midj6ShhYRa3Sl3xMTOLuIjAYxRwmdPkmkWt+3t97SVKmg:mEjpvYc3QxMI7TwmdMlL992VKmg

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1020	nswitkh.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\nswitkh.exe	311aed728284c35387049456677fc942df73dece364f5429ea4d6a93029f373c.exe
File created	C:\PROGRA~3\Mozilla\zgooxfa.dll	nswitkh.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1020	1116	taskeng.exe	29
PID 1116 wrote to memory of 1020	1116	taskeng.exe	29
PID 1116 wrote to memory of 1020	1116	taskeng.exe	29
PID 1116 wrote to memory of 1020	1116	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\311aed728284c35387049456677fc942df73dece364f5429ea4d6a93029f373c.exe
"C:\Users\Admin\AppData\Local\Temp\311aed728284c35387049456677fc942df73dece364f5429ea4d6a93029f373c.exe"
1⤵
- Drops file in Program Files directory
PID:1928

C:\Windows\system32\taskeng.exe
taskeng.exe {B22488B7-5A8F-4C04-916F-5BDFAB68C106} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1116
- C:\PROGRA~3\Mozilla\nswitkh.exe
  C:\PROGRA~3\Mozilla\nswitkh.exe -vhgoixm
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
140KB

MD5
9ddc987e6525d1972b7b2adfeb689966

SHA1
34725058ac4c821a28e769c8c241bc1e488c82de

SHA256
db5041492a9dd83893632399bfc8821f665a0310a3fc872f40b51ac9ef370fc2

SHA512
df4f850e28e18782ba2aa5c1444168410dfce322c0f1c7d98b60bbc9c77270452c7f68db3c8a17db9d4a192b707b505cb7cc01ff2d3dd246ce69d3bdbeaace4a

Download Submit
C:\PROGRA~3\Mozilla\nswitkh.exe

Filesize
140KB

MD5
9ddc987e6525d1972b7b2adfeb689966

SHA1
34725058ac4c821a28e769c8c241bc1e488c82de

SHA256
db5041492a9dd83893632399bfc8821f665a0310a3fc872f40b51ac9ef370fc2

SHA512
df4f850e28e18782ba2aa5c1444168410dfce322c0f1c7d98b60bbc9c77270452c7f68db3c8a17db9d4a192b707b505cb7cc01ff2d3dd246ce69d3bdbeaace4a

Download Submit
memory/1020-65-0x0000000000320000-0x000000000037B000-memory.dmp

Filesize
364KB

Download
memory/1928-54-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1928-55-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1928-56-0x0000000000350000-0x00000000003AB000-memory.dmp

Filesize
364KB

Download