9c08cdf9daa8a86033c1d5964a7548d8c3cf0db9c09273571a298e29496db35d

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c08cdf9daa8a86033c1d5964a7548d8c3cf0db9c09273571a298e29496db35d.exe
Size

429KB
MD5

068e0079e9e30bb0285632fc88d38d50
SHA1

b958a663cb9b240a841affe85f0cce5049adde44
SHA256

9c08cdf9daa8a86033c1d5964a7548d8c3cf0db9c09273571a298e29496db35d
SHA512

108681950b4103d857a77f8be40dc9e1e76cf529a40b27e0778358f15bca3eba26c8d0c135b4a8c1b6dc76cbde914331164d97e5bef5192c7a93f3d6d835ec17
SSDEEP

12288:CDJM/bXntAh+nhZoqQEHvVIzJPz//DdvdYkA:Cd6atqLHNk5Tdvo

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4316	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	9c08cdf9daa8a86033c1d5964a7548d8c3cf0db9c09273571a298e29496db35d.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\9c08cdf9daa8a86033c1d5964a7548d8c3cf0db9c09273571a298e29496db35d.exe
"C:\Users\Admin\AppData\Local\Temp\9c08cdf9daa8a86033c1d5964a7548d8c3cf0db9c09273571a298e29496db35d.exe"
1⤵
- Drops file in Program Files directory
PID:1772

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4316

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
429KB

MD5
65e12c68c01bbc58073e554967bbd1cb

SHA1
f1ba25f92e40fc3dba3d8970c327e5bbd79e5be6

SHA256
a87aa8ac6e32b48b6385f8b00cbf0d1513ad15bd00eb1f01e48f4db50abf0aad

SHA512
0a9ec8dc90a30677cdb2c7507224b58d14f8f08fef14ea7f1f573659835516a68c7b3ccbd49aaf8ecde3b78dd7e9f0259854140855f5e93db8b14eafe29b97e3

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
429KB

MD5
65e12c68c01bbc58073e554967bbd1cb

SHA1
f1ba25f92e40fc3dba3d8970c327e5bbd79e5be6

SHA256
a87aa8ac6e32b48b6385f8b00cbf0d1513ad15bd00eb1f01e48f4db50abf0aad

SHA512
0a9ec8dc90a30677cdb2c7507224b58d14f8f08fef14ea7f1f573659835516a68c7b3ccbd49aaf8ecde3b78dd7e9f0259854140855f5e93db8b14eafe29b97e3

Download Submit
memory/1772-132-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1772-133-0x00000000004F0000-0x000000000054B000-memory.dmp

Filesize
364KB

Download
memory/1772-140-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4316-141-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4316-142-0x00000000008D0000-0x000000000092B000-memory.dmp

Filesize
364KB

Download