6974449cc1cd90346227a4515bba8a8f30a8845dd840efa5331893e4728061c6

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6974449cc1cd90346227a4515bba8a8f30a8845dd840efa5331893e4728061c6.exe
Size

136KB
MD5

5a66ef8651d2f65cf2ede4da4e370bf0
SHA1

7702ca7b99930328d28382cbf6c4559fefa5ecf2
SHA256

6974449cc1cd90346227a4515bba8a8f30a8845dd840efa5331893e4728061c6
SHA512

bb8a66efd0f266e59bc92cfddf39420c9b0f6011e5cbdd2250279fa6f3c9618ba6ca8b24696444051cdae29f51262de9b220aae8d165f0a23e7016689ab34fa4
SSDEEP

3072:+WAf5zKL4y8hrNxhlYDKgXTXd5o9e+9lqOLVrhq+:vm5zo4yGY+gXTVsldLVVP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
876	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	6974449cc1cd90346227a4515bba8a8f30a8845dd840efa5331893e4728061c6.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\6974449cc1cd90346227a4515bba8a8f30a8845dd840efa5331893e4728061c6.exe
"C:\Users\Admin\AppData\Local\Temp\6974449cc1cd90346227a4515bba8a8f30a8845dd840efa5331893e4728061c6.exe"
1⤵
- Drops file in Program Files directory
PID:2692

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
136KB

MD5
97cc171be554582d259e1d28578b2ce2

SHA1
1d695cf1e84d04bf10322f65128fae305f0bcc34

SHA256
fc23d65b6fdd74afbe66a1af06f5627d58b00e79ae978b07d4455911b7383c67

SHA512
421e53841844454ecb081aad4e52f0ceb0b5500a49251b5c8edc3245bf0d7129a79cf129be25233da90a4bf25d30ba3169fbf40c47cae74566c67b408044825a

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
136KB

MD5
97cc171be554582d259e1d28578b2ce2

SHA1
1d695cf1e84d04bf10322f65128fae305f0bcc34

SHA256
fc23d65b6fdd74afbe66a1af06f5627d58b00e79ae978b07d4455911b7383c67

SHA512
421e53841844454ecb081aad4e52f0ceb0b5500a49251b5c8edc3245bf0d7129a79cf129be25233da90a4bf25d30ba3169fbf40c47cae74566c67b408044825a

Download Submit
memory/876-141-0x0000000000D00000-0x0000000000D5B000-memory.dmp

Filesize
364KB

Download
memory/876-146-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2692-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2692-133-0x0000000000740000-0x000000000079B000-memory.dmp

Filesize
364KB

Download
memory/2692-138-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download