63966f9f796dc8cbde744ac71c4d46a65f7646792b98bb4bc4b53dcb9ac163f1

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 22:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63966f9f796dc8cbde744ac71c4d46a65f7646792b98bb4bc4b53dcb9ac163f1.exe
Size

332KB
MD5

40d48de1461d1fe01fb4a1faf1f5f4e9
SHA1

aff2ab72069a4ba56ab6635dabf0bafb8259623c
SHA256

63966f9f796dc8cbde744ac71c4d46a65f7646792b98bb4bc4b53dcb9ac163f1
SHA512

21407b8cf58ff5abb47ff7f20856f154c93dbc2f727579d152bfca43fe5932a1e62aae72f00c9237964637f88c827a25872a34c0664c51a4cca0c7670b94e1d7
SSDEEP

6144:2hGiVdIhfuqeT5poLFPj52lvx5ZJ1pvaCqehyNh:2hVdIwT30dj52lXZJ9q4ah

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112

Executes dropped EXE 1 IoCs

pid	Process
3920	bzwkzdm.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\bzwkzdm.exe	63966f9f796dc8cbde744ac71c4d46a65f7646792b98bb4bc4b53dcb9ac163f1.exe
File created	C:\PROGRA~3\Mozilla\ccfurjb.dll	bzwkzdm.exe

C:\Users\Admin\AppData\Local\Temp\63966f9f796dc8cbde744ac71c4d46a65f7646792b98bb4bc4b53dcb9ac163f1.exe
"C:\Users\Admin\AppData\Local\Temp\63966f9f796dc8cbde744ac71c4d46a65f7646792b98bb4bc4b53dcb9ac163f1.exe"
1⤵
- Drops file in Program Files directory
PID:1012

C:\PROGRA~3\Mozilla\bzwkzdm.exe
C:\PROGRA~3\Mozilla\bzwkzdm.exe -yumuzjf
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\bzwkzdm.exe

Filesize
332KB

MD5
21588b7586a27265fbb7a3cd1557c8c8

SHA1
cfe00627772d729483b6945f0f9cf6acf977fae4

SHA256
46672db08262d847793aa34c9cda93a0b7dc94ae55c228bf0d434efc9c8ca645

SHA512
d706d84e68eb4ddc377b9a2e30204af23a35e4f4970bf784039f9f86c71dc48de6353ca67aab824dd0f1b38bde31a7fe5fe8188ad939e7a16fc202e6e2de305a

Download Submit
memory/1012-0-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1012-1-0x00000000020C0000-0x000000000211B000-memory.dmp

Filesize
364KB

Download
memory/1012-2-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1012-12-0x00000000020C0000-0x000000000211B000-memory.dmp

Filesize
364KB

Download
memory/1012-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3920-6-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3920-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3920-8-0x0000000000CA0000-0x0000000000CFB000-memory.dmp

Filesize
364KB

Download
memory/3920-14-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download