85749c2f695c8e3634b0d12cf7b6e507aa9694e9c5a92581dad4a054ccd32b9a

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.99fad649d9aa7a2c91dbd8a4326b8620_JC.exe
Size

256KB
MD5

99fad649d9aa7a2c91dbd8a4326b8620
SHA1

3360a8c7c10bd216da9fcfc162523d74c06f41ca
SHA256

85749c2f695c8e3634b0d12cf7b6e507aa9694e9c5a92581dad4a054ccd32b9a
SHA512

ec4e9a446f805ec9aa912abf7d9abca2d9e2bd70dffab8f1f2728504afd559c43a376e35b28af1854716c949b7195683be4dfa90bf2cada6a39b15c5655ab71d
SSDEEP

6144:dFZOSgIhBBQERJpJBQHEJVLiRz96fUjt3:Lo4vQ4JWHLz96y

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
2692	zimfrwc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\zimfrwc.exe	NEAS.99fad649d9aa7a2c91dbd8a4326b8620_JC.exe
File created	C:\PROGRA~3\Mozilla\pjqvbbf.dll	zimfrwc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2692	1336	taskeng.exe	29
PID 1336 wrote to memory of 2692	1336	taskeng.exe	29
PID 1336 wrote to memory of 2692	1336	taskeng.exe	29
PID 1336 wrote to memory of 2692	1336	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.99fad649d9aa7a2c91dbd8a4326b8620_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.99fad649d9aa7a2c91dbd8a4326b8620_JC.exe"
1⤵
- Drops file in Program Files directory
PID:2476

C:\Windows\system32\taskeng.exe
taskeng.exe {F7622D47-6EAF-46A1-B936-FC5BA3D11E9B} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1336
- C:\PROGRA~3\Mozilla\zimfrwc.exe
  C:\PROGRA~3\Mozilla\zimfrwc.exe -gtjzibe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\zimfrwc.exe

Filesize
256KB

MD5
8a5e64d3883df27befbc637ea1290e55

SHA1
0886e019077952e3b9967ea2f009633e49d1cf78

SHA256
273094b3e4c660fbea45170d82576df18439110f8875c43fd7d11ef468e4b3c2

SHA512
58f3c7d63be306ccfe533304fc8768f1753d50fe1a6b55f7941e06f71f9efbaf287c832f9ca51068a4865022afb898332ad919d8d7498119d2add0c52aaa882c

Download Submit
C:\PROGRA~3\Mozilla\zimfrwc.exe

Filesize
256KB

MD5
8a5e64d3883df27befbc637ea1290e55

SHA1
0886e019077952e3b9967ea2f009633e49d1cf78

SHA256
273094b3e4c660fbea45170d82576df18439110f8875c43fd7d11ef468e4b3c2

SHA512
58f3c7d63be306ccfe533304fc8768f1753d50fe1a6b55f7941e06f71f9efbaf287c832f9ca51068a4865022afb898332ad919d8d7498119d2add0c52aaa882c

Download Submit
memory/2476-0-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2476-1-0x0000000000220000-0x000000000027B000-memory.dmp

Filesize
364KB

Download
memory/2476-7-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2692-10-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2692-11-0x0000000000890000-0x00000000008EB000-memory.dmp

Filesize
364KB

Download
memory/2692-17-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download