Analysis
-
max time kernel
146s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 00:00
Static task
static1
Behavioral task
behavioral1
Sample
1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe
Resource
win10v2004-20240508-en
General
-
Target
1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe
-
Size
561KB
-
MD5
eda2cb25ddd98efd096529388d38e9b0
-
SHA1
24dccce9998dbd42f3c303a32f80a2eb2e09d5b2
-
SHA256
1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd
-
SHA512
a7a2e561329f9359f630e65305cdd5115db3198db5eaaa7d6784dc209d6b97aed694da44ba843acd3b331cd81a74b71540d9bbd46063555319a9d87d0efb7460
-
SSDEEP
12288:tBXXXXXXXXXAXX7hx6UhqXmZ1Xok3IpaZQ10hSnA/Qz5wYGfU:sx6Uo01j3IsprI7GfU
Malware Config
Signatures
-
Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Executes dropped EXE 1 IoCs
pid Process 896 ywswmda.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\PROGRA~3\Mozilla\ywswmda.exe 1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe File created C:\PROGRA~3\Mozilla\dzldqrl.dll ywswmda.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe"C:\Users\Admin\AppData\Local\Temp\1ef6bcd84eb530609d194f6b3961d3dbe99fb5d3d23d9fca07a420c1e3f774dd.exe"1⤵
- Drops file in Program Files directory
PID:2588
-
C:\PROGRA~3\Mozilla\ywswmda.exeC:\PROGRA~3\Mozilla\ywswmda.exe -zhzkoil1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
561KB
MD5f41ac317e2125760401d552b8acf3443
SHA1e6f7122310b32b2d2cfb8b457141c80ebdfe502c
SHA256b3027eab3acc4fda818688688c0f33fc63a5245e0107616b90f6f4a54c63db9a
SHA51280ce1ee4a1d349367dbe0dd015f8e7c1ed0a7f816080cdeda38d83631d9cd2ffa47709c04b7ad8964e42761a28c7f52d56bca30caf11833c11f0972b24865807