79c78878bdd25f8318bfa7f89f653477cd0fcbfd302f5bf11b29b47871bc0a63

Analysis

max time kernel
92s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 22:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79c78878bdd25f8318bfa7f89f653477cd0fcbfd302f5bf11b29b47871bc0a63.exe
Size

148KB
MD5

8aa0872076420c08de19c58dff6c03f9
SHA1

9ed9030fe4e9d0420d5cd7d0a4acb7db71cbfda9
SHA256

79c78878bdd25f8318bfa7f89f653477cd0fcbfd302f5bf11b29b47871bc0a63
SHA512

4b1ad5edc7b45951328f7297754fb37e03a2adbd34e143ef8836bd1d7d8807f13949f1e2c0713156647ff3aeb8de517f573331006610e4d2c20a8d5a5ccea78b
SSDEEP

3072:CDUp8yetaIBOvnMqllHQmkKtaY/JB/KMu0oS2rOaQn3OOXluZLq290LAP/0y+nMx:CDJVazMKV31FdaQvXluxqU+A/0y+nMI6

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
3060	frviiqj.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\frviiqj.exe	79c78878bdd25f8318bfa7f89f653477cd0fcbfd302f5bf11b29b47871bc0a63.exe
File created	C:\PROGRA~3\Mozilla\sjqrgse.dll	frviiqj.exe

C:\Users\Admin\AppData\Local\Temp\79c78878bdd25f8318bfa7f89f653477cd0fcbfd302f5bf11b29b47871bc0a63.exe
"C:\Users\Admin\AppData\Local\Temp\79c78878bdd25f8318bfa7f89f653477cd0fcbfd302f5bf11b29b47871bc0a63.exe"
1⤵
- Drops file in Program Files directory
PID:4848

C:\PROGRA~3\Mozilla\frviiqj.exe
C:\PROGRA~3\Mozilla\frviiqj.exe -myayasb
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\frviiqj.exe

Filesize
148KB

MD5
4f9401154dd0a6258e236f6e19bfc17d

SHA1
94d9d12927dbd7d56a5381d3fdbe559381b14659

SHA256
cb3fb81ac16c47a73a3798746bd516b5e3c729d7c2e339323cae528d9f692a36

SHA512
7e009b70af6924289c97556aedb5a3a927c32f6f53479d08fb6cab013466b9ddda4d03090f338353169a9f6c5408fd617e922df87aae0b97df8ff6e3143ab5f6

Download Submit
memory/3060-10-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/3060-11-0x00000000004E0000-0x000000000053B000-memory.dmp

Filesize
364KB

Download
memory/3060-17-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4848-0-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4848-1-0x00000000006C0000-0x000000000071B000-memory.dmp

Filesize
364KB

Download
memory/4848-9-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download