1d50d4bb6f2dd7af520b2d2aebc3fc98092752fad858cbc64860bbd3f42dc706

Analysis

max time kernel
81s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d50d4bb6f2dd7af520b2d2aebc3fc98092752fad858cbc64860bbd3f42dc706.exe
Size

260KB
MD5

846f23d49c42a916ad27cf28997a24f0
SHA1

d9d307c7a7c59d878d522bfce64c3ab1ea607478
SHA256

1d50d4bb6f2dd7af520b2d2aebc3fc98092752fad858cbc64860bbd3f42dc706
SHA512

22d2e48ce820621244802f6ec0417a512a5612c39d119d49f193ef25863d06f82fd682e2d00da5f9a0c0cfbd47f583eaf19633df01c2e78cb19b2c294a1e6dcd
SSDEEP

6144:CDJVazMKV31FdaQvXluxqU+A/0y+nt75voqQEnHv0CxN8H9R/:CDJM/bXntAh+nhZoqQEHvVIz/

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2588	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	1d50d4bb6f2dd7af520b2d2aebc3fc98092752fad858cbc64860bbd3f42dc706.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\1d50d4bb6f2dd7af520b2d2aebc3fc98092752fad858cbc64860bbd3f42dc706.exe
"C:\Users\Admin\AppData\Local\Temp\1d50d4bb6f2dd7af520b2d2aebc3fc98092752fad858cbc64860bbd3f42dc706.exe"
1⤵
- Drops file in Program Files directory
PID:3272

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
260KB

MD5
efb769515b34d90dc723d3ef88fdab70

SHA1
aaa18f7582d78a31345d8efe57649890d49ffac9

SHA256
90fd32cf8d5a5f4bdb04040d0c723d3a8ea3184e784a3db05fde5ade7fdcde24

SHA512
6f5b582150a283b55dd3ce619b7c156da662099a6b5c18288b64766e7fdf44b5de024f227ae331a8a5779576506297f8ac4069659fd93543728002688b37ec21

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
260KB

MD5
efb769515b34d90dc723d3ef88fdab70

SHA1
aaa18f7582d78a31345d8efe57649890d49ffac9

SHA256
90fd32cf8d5a5f4bdb04040d0c723d3a8ea3184e784a3db05fde5ade7fdcde24

SHA512
6f5b582150a283b55dd3ce619b7c156da662099a6b5c18288b64766e7fdf44b5de024f227ae331a8a5779576506297f8ac4069659fd93543728002688b37ec21

Download Submit
memory/2588-141-0x00000000008D0000-0x000000000092B000-memory.dmp

Filesize
364KB

Download
memory/2588-146-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3272-132-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3272-133-0x0000000000900000-0x000000000095B000-memory.dmp

Filesize
364KB

Download
memory/3272-140-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download