Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 00:00

General

  • Target

    1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe

  • Size

    561KB

  • MD5

    eda2cb25ddd98efd096529388d38e9b0

  • SHA1

    24dccce9998dbd42f3c303a32f80a2eb2e09d5b2

  • SHA256

    1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd

  • SHA512

    a7a2e561329f9359f630e65305cdd5115db3198db5eaaa7d6784dc209d6b97aed694da44ba843acd3b331cd81a74b71540d9bbd46063555319a9d87d0efb7460

  • SSDEEP

    12288:tBXXXXXXXXXAXX7hx6UhqXmZ1Xok3IpaZQ10hSnA/Qz5wYGfU:sx6Uo01j3IsprI7GfU

Malware Config

Signatures

  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Executes dropped EXE 1 IoCs
  • Drops file in Program Files directory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe
    "C:\Users\Admin\AppData\Local\Temp\1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe"
    1⤵
    • Drops file in Program Files directory
    PID:2588
  • C:\PROGRA~3\Mozilla\ywswmda.exe
    C:\PROGRA~3\Mozilla\ywswmda.exe -zhzkoil
    1⤵
    • Executes dropped EXE
    • Drops file in Program Files directory
    PID:896

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Mozilla\ywswmda.exe

    Filesize

    561KB

    MD5

    f41ac317e2125760401d552b8acf3443

    SHA1

    e6f7122310b32b2d2cfb8b457141c80ebdfe502c

    SHA256

    b3027eab3acc4fda818688688c0f33fc63a5245e0107616b90f6f4a54c63db9a

    SHA512

    80ce1ee4a1d349367dbe0dd015f8e7c1ed0a7f816080cdeda38d83631d9cd2ffa47709c04b7ad8964e42761a28c7f52d56bca30caf11833c11f0972b24865807

  • memory/896-6-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/896-9-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/896-7-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/896-13-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2588-0-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2588-1-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB

  • memory/2588-2-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/2588-11-0x0000000000400000-0x000000000045B000-memory.dmp

    Filesize

    364KB