27aa9761a9c8cf778ac6355bcc411ee200a3d96861ae55ab2910b2ba04a0d4bf

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/06/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27aa9761a9c8cf778ac6355bcc411ee200a3d96861ae55ab2910b2ba04a0d4bf.exe
Size

162KB
MD5

9a0605c1f181195a06c674aa44746602
SHA1

671bc21fc968530f1201fd029422f5796fd7829f
SHA256

27aa9761a9c8cf778ac6355bcc411ee200a3d96861ae55ab2910b2ba04a0d4bf
SHA512

94f2fe68af0d3f4fa8f6abc358e94803852cc9a36a14166cb54f636e37247d53a0dfa4c154dce46c62ceefc9b2cf18e96d71811b30ca59ff11b3da29effb4fac
SSDEEP

3072:51oVtum4WHvjVGr8kgB9s8p+uRcKVHM0lma3UroAew5ak23n2MgN8DljS:5mtmCjkU9Wu6uFYwsegak22TQle

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
4712	ywswmda.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\ywswmda.exe	27aa9761a9c8cf778ac6355bcc411ee200a3d96861ae55ab2910b2ba04a0d4bf.exe
File created	C:\PROGRA~3\Mozilla\dzldqrl.dll	ywswmda.exe

C:\Users\Admin\AppData\Local\Temp\27aa9761a9c8cf778ac6355bcc411ee200a3d96861ae55ab2910b2ba04a0d4bf.exe
"C:\Users\Admin\AppData\Local\Temp\27aa9761a9c8cf778ac6355bcc411ee200a3d96861ae55ab2910b2ba04a0d4bf.exe"
1⤵
- Drops file in Program Files directory
PID:1228

C:\PROGRA~3\Mozilla\ywswmda.exe
C:\PROGRA~3\Mozilla\ywswmda.exe -zhzkoil
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\ywswmda.exe

Filesize
162KB

MD5
2707ad616cb8a1a8b631d41ea7fcdb17

SHA1
98569799586d52103ca104a4b428d631dfd7325b

SHA256
510ab4dfb56e94343a1a35265daabc86c5670667b95651bbfcdc097d72f830f5

SHA512
618379096d24db2a0ea2eb22f116e29c03149967e96bd69d028290f1b50ca7e7bd9a9e348fcdea4ecc42dccef560119f1a89c55a6d981aa68d1864490d235042

Download Submit
memory/1228-0-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1228-1-0x0000000002090000-0x00000000020B2000-memory.dmp

Filesize
136KB

Download
memory/1228-3-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1228-2-0x00000000020C0000-0x000000000211B000-memory.dmp

Filesize
364KB

Download
memory/1228-8-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4712-10-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4712-11-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4712-13-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download