4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022

General

Target

4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe
Size

10.9MB
MD5

5aff000c9f9995c8655dd5f792e8397f
SHA1

fede482ca000a1449a7aeee1438761b29656510b
SHA256

4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022
SHA512

ee029090fcaef8ad31f173188a39c91d5de1c86d308e88853d50d7cab0bd58d6e1e1343fea1f009e2f6fd816cdca80f114427c75c9e2660d418c79765fc5f23a
SSDEEP

196608:qMFAOaHjtE1z8Htc+8jmfZsuolXAVmQKOeHuGcagNGfS0SOKSI8p8oczS:qcaHjtEcc6GWdeOtGfSHSFm

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
908	MozillaMozilla-type0.5.0.7.exe

Loads dropped DLL 1 IoCs

pid	Process
940	4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\MozillaMozilla-type0.5.0.7 = "C:\\ProgramData\\MozillaMozilla-type0.5.0.7\\MozillaMozilla-type0.5.0.7.exe"	4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
940	4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe
908	MozillaMozilla-type0.5.0.7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 908	940	4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe	28
PID 940 wrote to memory of 908	940	4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe	28
PID 940 wrote to memory of 908	940	4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe	28
PID 940 wrote to memory of 908	940	4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe	28

C:\Users\Admin\AppData\Local\Temp\4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe
"C:\Users\Admin\AppData\Local\Temp\4f7240395c0d68ad0b4bc4c240b86d770e856f4ed86cee8638dece198014d022.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:940
- C:\ProgramData\MozillaMozilla-type0.5.0.7\MozillaMozilla-type0.5.0.7.exe
  "C:\ProgramData\MozillaMozilla-type0.5.0.7\MozillaMozilla-type0.5.0.7.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\MozillaMozilla-type0.5.0.7\MozillaMozilla-type0.5.0.7.exe

Filesize
587.7MB

MD5
e8419e109ccd04946a22ccc55ede592b

SHA1
597943ecfdf891b57f645c336d985ab300c7b402

SHA256
aed5d3a5db16908ef4e6863e502ece372d144d22c5638b8ce929ed90f2f6e8f1

SHA512
eb1ab959ef98cd13f76caa88510e018fb738d1a54a84e2c4bf087834d71edab942ccd426bc50ec769f7178d8ea069dbbbac05b702a1413715b9d8e87debe8dab

Download Submit
C:\ProgramData\MozillaMozilla-type0.5.0.7\MozillaMozilla-type0.5.0.7.exe

Filesize
587.7MB

MD5
e8419e109ccd04946a22ccc55ede592b

SHA1
597943ecfdf891b57f645c336d985ab300c7b402

SHA256
aed5d3a5db16908ef4e6863e502ece372d144d22c5638b8ce929ed90f2f6e8f1

SHA512
eb1ab959ef98cd13f76caa88510e018fb738d1a54a84e2c4bf087834d71edab942ccd426bc50ec769f7178d8ea069dbbbac05b702a1413715b9d8e87debe8dab

Download Submit
\ProgramData\MozillaMozilla-type0.5.0.7\MozillaMozilla-type0.5.0.7.exe

Filesize
587.7MB

MD5
e8419e109ccd04946a22ccc55ede592b

SHA1
597943ecfdf891b57f645c336d985ab300c7b402

SHA256
aed5d3a5db16908ef4e6863e502ece372d144d22c5638b8ce929ed90f2f6e8f1

SHA512
eb1ab959ef98cd13f76caa88510e018fb738d1a54a84e2c4bf087834d71edab942ccd426bc50ec769f7178d8ea069dbbbac05b702a1413715b9d8e87debe8dab

Download Submit
memory/908-72-0x0000000000400000-0x0000000001506000-memory.dmp

Filesize
17.0MB

Download
memory/908-71-0x0000000000400000-0x0000000001506000-memory.dmp

Filesize
17.0MB

Download
memory/908-66-0x0000000000400000-0x0000000001506000-memory.dmp

Filesize
17.0MB

Download
memory/908-67-0x0000000000400000-0x0000000001506000-memory.dmp

Filesize
17.0MB

Download
memory/940-59-0x0000000000400000-0x0000000001506000-memory.dmp

Filesize
17.0MB

Download
memory/940-65-0x0000000000400000-0x0000000001506000-memory.dmp

Filesize
17.0MB

Download
memory/940-60-0x0000000000400000-0x0000000001506000-memory.dmp

Filesize
17.0MB

Download
memory/940-54-0x0000000000400000-0x0000000001506000-memory.dmp

Filesize
17.0MB

Download
memory/940-58-0x0000000000400000-0x0000000001506000-memory.dmp

Filesize
17.0MB

Download
memory/940-57-0x00000000760A1000-0x00000000760A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing