2cf2e6cd68f99109073f6f42bc7d2b71763909798df077832c104027dcd3114d

Analysis

max time kernel
52s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cf2e6cd68f99109073f6f42bc7d2b71763909798df077832c104027dcd3114d.exe
Size

233KB
MD5

27fcfe6e4e53f50cbddbee2ffb1735f0
SHA1

97e47034230ffc19fa7f32baf1f4310bc924f68a
SHA256

2cf2e6cd68f99109073f6f42bc7d2b71763909798df077832c104027dcd3114d
SHA512

f511bd4af841af06f6099bf7db9c0c3105673f9fde116a7a7721f175cee2e37081a33950aa006e787afdf0ddb482b49ab1310b9ac0dff24ff9aecbb3da41dfe2
SSDEEP

6144:eSH4NMEb+LED2x8mxkmmxXnlw/xfnj5ht:eSH9Eb+LEC9xsJ4j5h

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2024	sgfgrig.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\sgfgrig.exe	2cf2e6cd68f99109073f6f42bc7d2b71763909798df077832c104027dcd3114d.exe
File created	C:\PROGRA~3\Mozilla\ogcwmgm.dll	sgfgrig.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1136	2cf2e6cd68f99109073f6f42bc7d2b71763909798df077832c104027dcd3114d.exe
2024	sgfgrig.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2024	1988	taskeng.exe	28
PID 1988 wrote to memory of 2024	1988	taskeng.exe	28
PID 1988 wrote to memory of 2024	1988	taskeng.exe	28
PID 1988 wrote to memory of 2024	1988	taskeng.exe	28

C:\Users\Admin\AppData\Local\Temp\2cf2e6cd68f99109073f6f42bc7d2b71763909798df077832c104027dcd3114d.exe
"C:\Users\Admin\AppData\Local\Temp\2cf2e6cd68f99109073f6f42bc7d2b71763909798df077832c104027dcd3114d.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:1136

C:\Windows\system32\taskeng.exe
taskeng.exe {F7B166FA-A609-437D-888F-46FAA0FE5218} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\PROGRA~3\Mozilla\sgfgrig.exe
  C:\PROGRA~3\Mozilla\sgfgrig.exe -smuvcxh
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\sgfgrig.exe

Filesize
233KB

MD5
81a1aa3c3e7886aa10102b37786ebb5e

SHA1
41312427d209e830e599a17ccc467558eb88b4d3

SHA256
3b2f7e6ceb3b819cb0fc8e5ea4d94cead12129cd70078b84d9b1423990f09105

SHA512
2f8d92416c6d3ba2a6d1f91b0aba0f42437711f246a8d7914eaece685555d9afa378dc55c834adeabeb6c2da53afdb6aa25a8bcc327e5ab1558dbfd1e6efecf4

Download Submit
C:\PROGRA~3\Mozilla\sgfgrig.exe

Filesize
233KB

MD5
81a1aa3c3e7886aa10102b37786ebb5e

SHA1
41312427d209e830e599a17ccc467558eb88b4d3

SHA256
3b2f7e6ceb3b819cb0fc8e5ea4d94cead12129cd70078b84d9b1423990f09105

SHA512
2f8d92416c6d3ba2a6d1f91b0aba0f42437711f246a8d7914eaece685555d9afa378dc55c834adeabeb6c2da53afdb6aa25a8bcc327e5ab1558dbfd1e6efecf4

Download Submit
memory/1136-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1136-55-0x0000000000250000-0x00000000002AB000-memory.dmp

Filesize
364KB

Download
memory/1136-56-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1136-57-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1136-58-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2024-63-0x00000000004D0000-0x000000000052B000-memory.dmp

Filesize
364KB

Download
memory/2024-64-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2024-65-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download