d4b6d91d2a48c92f6a6ade0f07f47269ed4ae481f1f911e83b8f81535ca78fc2

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a5ea4552d9b60878f414c982a3b8520N.exe
Size

178KB
MD5

3a5ea4552d9b60878f414c982a3b8520
SHA1

e16529914dcbc58b51aefea64f860c5d0ce58b79
SHA256

d4b6d91d2a48c92f6a6ade0f07f47269ed4ae481f1f911e83b8f81535ca78fc2
SHA512

b1bae62dd75e4e99e9a1baf3fbd36b9b769cb447e059d8cd5cbd4d3d86689f2a3766228ce6382a9a4a061b64a59b7c5ef2755add8f95dea9567199838aca5daa
SSDEEP

3072:LDTQGUHkkPkIxS5qWOSIOjq1wuFNIkDqSI6ClUGMu5pV8W6NwMiS50bNas4H9ga8:3dUU5cSIOGf2kDqSgBMu55of50o1ga8

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
1488	qrggcen.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\qrggcen.exe	3a5ea4552d9b60878f414c982a3b8520N.exe
File created	C:\PROGRA~3\Mozilla\zwjbghb.dll	qrggcen.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2240	3a5ea4552d9b60878f414c982a3b8520N.exe
1488	qrggcen.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1488	1904	taskeng.exe	29
PID 1904 wrote to memory of 1488	1904	taskeng.exe	29
PID 1904 wrote to memory of 1488	1904	taskeng.exe	29
PID 1904 wrote to memory of 1488	1904	taskeng.exe	29

C:\Users\Admin\AppData\Local\Temp\3a5ea4552d9b60878f414c982a3b8520N.exe
"C:\Users\Admin\AppData\Local\Temp\3a5ea4552d9b60878f414c982a3b8520N.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of UnmapMainImage
PID:2240

C:\Windows\system32\taskeng.exe
taskeng.exe {F2BFC5E5-DDAE-4F9B-9C3C-819465BD569F} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\PROGRA~3\Mozilla\qrggcen.exe
  C:\PROGRA~3\Mozilla\qrggcen.exe -cochpwl
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of UnmapMainImage
  PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\qrggcen.exe

Filesize
178KB

MD5
dbdedab59d2c9cf9de86864b77dc4b79

SHA1
b755f4ff921b39d0e33bfabf496994a6d5e0d0df

SHA256
2858cafbb1629456966bbbbd1a8bc36da0e42c8cea200e7364fd57a52549aaa8

SHA512
bb562482478bd0659fcd1725dce89f06910f0d932bf7f769a645730548966d366047a98ea47d45bbbf0f4fe56548e82c6958f0cadf2e80ca76c5f83a3c71d832

Download Submit
memory/1488-7-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1488-8-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1488-10-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-0-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download
memory/2240-1-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-3-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2240-4-0x00000000002F0000-0x000000000034B000-memory.dmp

Filesize
364KB

Download