1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd

Analysis

max time kernel
146s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe
Size

561KB
MD5

eda2cb25ddd98efd096529388d38e9b0
SHA1

24dccce9998dbd42f3c303a32f80a2eb2e09d5b2
SHA256

1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd
SHA512

a7a2e561329f9359f630e65305cdd5115db3198db5eaaa7d6784dc209d6b97aed694da44ba843acd3b331cd81a74b71540d9bbd46063555319a9d87d0efb7460
SSDEEP

12288:tBXXXXXXXXXAXX7hx6UhqXmZ1Xok3IpaZQ10hSnA/Qz5wYGfU:sx6Uo01j3IsprI7GfU

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
896	ywswmda.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\ywswmda.exe	1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe
File created	C:\PROGRA~3\Mozilla\dzldqrl.dll	ywswmda.exe

C:\Users\Admin\AppData\Local\Temp\1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe
"C:\Users\Admin\AppData\Local\Temp\1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe"
1⤵
- Drops file in Program Files directory
PID:2588

C:\PROGRA~3\Mozilla\ywswmda.exe
C:\PROGRA~3\Mozilla\ywswmda.exe -zhzkoil
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla\ywswmda.exe

Filesize
561KB

MD5
f41ac317e2125760401d552b8acf3443

SHA1
e6f7122310b32b2d2cfb8b457141c80ebdfe502c

SHA256
b3027eab3acc4fda818688688c0f33fc63a5245e0107616b90f6f4a54c63db9a

SHA512
80ce1ee4a1d349367dbe0dd015f8e7c1ed0a7f816080cdeda38d83631d9cd2ffa47709c04b7ad8964e42761a28c7f52d56bca30caf11833c11f0972b24865807

Download Submit
memory/896-6-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/896-9-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/896-7-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/896-13-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2588-0-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2588-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2588-2-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2588-11-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download