4459eccd3ff12fe948420350acf32733b02f902f44856df608c58e0dd5ab397f

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23/11/2022, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4459eccd3ff12fe948420350acf32733b02f902f44856df608c58e0dd5ab397f.exe
Size

257KB
MD5

45335c1aea7fee9b6717e399de9d12a0
SHA1

71ee2acf9d2d7a1f6ace61ab55f88c2b4faded3d
SHA256

4459eccd3ff12fe948420350acf32733b02f902f44856df608c58e0dd5ab397f
SHA512

d1e315a8f45a122de12bf023b05d60ae1fb216ce9f50917719b982d6cec033ae9b192f1b6f9fe6ba9ce7a38a7a04f9227f30ee3ebab2484c1d58c7ec2da4ada5
SSDEEP

3072:xOzjAuUfkkPk4f/VUS/zQeMOXJ0n8eUu5J98WCNYMK6RsjFys4Ul6ta:eVUv/CSLQbu0jUu5BwXRsAMloa

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1436	fmzgwvi.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fmzgwvi.exe	4459eccd3ff12fe948420350acf32733b02f902f44856df608c58e0dd5ab397f.exe
File created	C:\PROGRA~3\Mozilla\atdvtif.dll	fmzgwvi.exe

C:\Users\Admin\AppData\Local\Temp\4459eccd3ff12fe948420350acf32733b02f902f44856df608c58e0dd5ab397f.exe
"C:\Users\Admin\AppData\Local\Temp\4459eccd3ff12fe948420350acf32733b02f902f44856df608c58e0dd5ab397f.exe"
1⤵
- Drops file in Program Files directory
PID:2068

C:\PROGRA~3\Mozilla\fmzgwvi.exe
C:\PROGRA~3\Mozilla\fmzgwvi.exe -gtfwajn
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fmzgwvi.exe

Filesize
257KB

MD5
a27816cdddb6609bfbdd8a01de964d7d

SHA1
131262af9a66135bd16b9f36c6d267cb1fa91893

SHA256
d2f5473a6b9aaac8cf9269fbb4f6e52e57254bafaf755cd6e1de5e57ef4f1917

SHA512
664728ff9e441e097dbf4673f1ccc23b7bd02920d515a808c5d82c2dfec2f2267beb25e6ecaed19cab6c53c50447206b30eb83188ff605886293aa80a40bef61

Download Submit
C:\ProgramData\Mozilla\fmzgwvi.exe

Filesize
257KB

MD5
a27816cdddb6609bfbdd8a01de964d7d

SHA1
131262af9a66135bd16b9f36c6d267cb1fa91893

SHA256
d2f5473a6b9aaac8cf9269fbb4f6e52e57254bafaf755cd6e1de5e57ef4f1917

SHA512
664728ff9e441e097dbf4673f1ccc23b7bd02920d515a808c5d82c2dfec2f2267beb25e6ecaed19cab6c53c50447206b30eb83188ff605886293aa80a40bef61

Download Submit
memory/1436-138-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1436-139-0x00000000005A0000-0x00000000005FB000-memory.dmp

Filesize
364KB

Download
memory/1436-140-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2068-132-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2068-133-0x0000000002200000-0x000000000225B000-memory.dmp

Filesize
364KB

Download
memory/2068-134-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2068-135-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download