95b18cab2a6a6de518e78f6314281cca182bdc1cdd1ca113c9e8aecfce2feb9b

Analysis

max time kernel
46s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95b18cab2a6a6de518e78f6314281cca182bdc1cdd1ca113c9e8aecfce2feb9b.exe
Size

160KB
MD5

82541bff6fe8b5c8c23ddd8597550850
SHA1

94321e3005e62f4074727fd100c8eee6f6775345
SHA256

95b18cab2a6a6de518e78f6314281cca182bdc1cdd1ca113c9e8aecfce2feb9b
SHA512

a72dfa0b0c0cdfe3ee2acdf9e20436f465a1abf9267fd409db284dff72918fa759096e2a9bcb75cc07e6549277b39ccdc2d2e1879824268eb4ea7c60ac3dbc18
SSDEEP

3072:1uoBFe14D81ADyvm9foJ4AtLDhOLZsNp7celajOleOxXa5PFl:1uoBFegDSm9gTLDILyjRAceOxXYFl

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1976	sgfgrig.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\sgfgrig.exe	95b18cab2a6a6de518e78f6314281cca182bdc1cdd1ca113c9e8aecfce2feb9b.exe
File created	C:\PROGRA~3\Mozilla\ogcwmgm.dll	sgfgrig.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 1976	1408	taskeng.exe	28
PID 1408 wrote to memory of 1976	1408	taskeng.exe	28
PID 1408 wrote to memory of 1976	1408	taskeng.exe	28
PID 1408 wrote to memory of 1976	1408	taskeng.exe	28

C:\Users\Admin\AppData\Local\Temp\95b18cab2a6a6de518e78f6314281cca182bdc1cdd1ca113c9e8aecfce2feb9b.exe
"C:\Users\Admin\AppData\Local\Temp\95b18cab2a6a6de518e78f6314281cca182bdc1cdd1ca113c9e8aecfce2feb9b.exe"
1⤵
- Drops file in Program Files directory
PID:1660

C:\Windows\system32\taskeng.exe
taskeng.exe {F7B166FA-A609-437D-888F-46FAA0FE5218} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1408
- C:\PROGRA~3\Mozilla\sgfgrig.exe
  C:\PROGRA~3\Mozilla\sgfgrig.exe -smuvcxh
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\sgfgrig.exe

Filesize
160KB

MD5
2037fed287f6f5b03821d7831ec8e04d

SHA1
a4605d8e557cd8d21e9ed82efb3880a53c860bb4

SHA256
00ed0ebb0e183bba174b77ffa7b0730dde4f36b7a1a5dc679293c6eeaf684823

SHA512
666eff51ad1ac3f2165a01e2543060075cfb9fa66f6271dd6a17ecb533a1ba9d7a7cce99bfdb8dfd6fbfed328b13051e7387c53ab32bcf9d15cd0e7a021d72ea

Download Submit
C:\PROGRA~3\Mozilla\sgfgrig.exe

Filesize
160KB

MD5
2037fed287f6f5b03821d7831ec8e04d

SHA1
a4605d8e557cd8d21e9ed82efb3880a53c860bb4

SHA256
00ed0ebb0e183bba174b77ffa7b0730dde4f36b7a1a5dc679293c6eeaf684823

SHA512
666eff51ad1ac3f2165a01e2543060075cfb9fa66f6271dd6a17ecb533a1ba9d7a7cce99bfdb8dfd6fbfed328b13051e7387c53ab32bcf9d15cd0e7a021d72ea

Download Submit
memory/1660-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1660-55-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1660-58-0x000000000043A000-0x000000000047D000-memory.dmp

Filesize
268KB

Download
memory/1660-59-0x0000000000430000-0x000000000048B000-memory.dmp

Filesize
364KB

Download
memory/1976-65-0x0000000000930000-0x000000000098B000-memory.dmp

Filesize
364KB

Download