7fa82d63dabfa0284c6c897cb16195a715e0cbe1e794cf47106c796d27e0b634

Analysis

max time kernel
233s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.FizzyLoader.exe
Size 296KB
Sample240504-lveahsdb33
SHA256 7fa82d63dabfa0284c6c897cb16195a715e0cbe1e794cf47106c796d27e0b634
MD5 2018b043d8098846dc14627899865216
SHA1 78a946de4ca8d2ef7886971f03bb4477a580fcd7
SHA512 03efe7e4758056602dff814a64adac486d3098fb8e2496ee210d17165673ade93ab26cae879856b51cc2165a79a4c61c1e9463febba7317cebb5af1587abf569
SSDEEP 6144:NhjY3fHcPBkpHPR8WIS9XgorLS6PaOKI0qc8cDbcVdH:QI6pvBqEeqc7sH
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1424	icacls.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 5092	656	.FizzyLoader.exe	92
PID 656 wrote to memory of 5092	656	.FizzyLoader.exe	92
PID 5092 wrote to memory of 1424	5092	javaw.exe	93
PID 5092 wrote to memory of 1424	5092	javaw.exe	93

C:\Users\Admin\AppData\Local\Temp\.FizzyLoader.exe
"C:\Users\Admin\AppData\Local\Temp\.FizzyLoader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:656
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath " org.develnext.jphp.ext.javafx.FXLauncher
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:1424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1348 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 8925d60befb0662efbafb068e9d0841cb6543466488ff97d3b30b66236436903
MD5 08db6f4073a58e21cbec8997955d8c81
SHA1 ebe12761c1d5c6d4f393997b15ea522ce8175961
SHA512 79065a24a7a50627ca16d6b615121327f9e13c2cb90e9535861d60c68e5a3808e1b39ebd5345ac048cfef8b5a09e8e8893e551d3b99fd1a2979c49e31afe00a4
MD5 SHA1 SHA512

Submit Download

memory/656-0-0x0000000000400000-0x0000000000457000-memory.dmp

Download

memory/5092-3-0x00000284AEA30000-0x00000284AECA0000-memory.dmp

Download

memory/5092-13-0x00000284AEA10000-0x00000284AEA11000-memory.dmp

Download

memory/5092-16-0x00000284AEA30000-0x00000284AECA0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads