ffd78b79c1acfcd48769dda249e6d1c568ab83bdfde7c4a95b1d42caab1ffdb1

Analysis

max time kernel
92s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffd78b79c1acfcd48769dda249e6d1c568ab83bdfde7c4a95b1d42caab1ffdb1.exe
Size

136KB
MD5

27576d2e3bff6533d0f78f8cfa07de5b
SHA1

4513c55f10054f1564e7f81a328a7878cc8d6484
SHA256

ffd78b79c1acfcd48769dda249e6d1c568ab83bdfde7c4a95b1d42caab1ffdb1
SHA512

0f7a3b5d3346a4620a96761b7b1327eb7fe76655eb05ff25ff0edce1197b6e8e382e498b1a640d000038a4524e223739d96bb997ed7194fd67695ce1bb7ee278
SSDEEP

3072:q99X4ATRtqdEY82XLT79O6W/0aC0VrETTrDFzH38dkjJZrx:E9ZtqqY82X3RObR4frxzsdkjJD

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 1 IoCs

pid	Process
2996	uvqnnih.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\uvqnnih.exe	ffd78b79c1acfcd48769dda249e6d1c568ab83bdfde7c4a95b1d42caab1ffdb1.exe
File created	C:\PROGRA~3\Mozilla\zdebidn.dll	uvqnnih.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffd78b79c1acfcd48769dda249e6d1c568ab83bdfde7c4a95b1d42caab1ffdb1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uvqnnih.exe

C:\Users\Admin\AppData\Local\Temp\ffd78b79c1acfcd48769dda249e6d1c568ab83bdfde7c4a95b1d42caab1ffdb1.exe
"C:\Users\Admin\AppData\Local\Temp\ffd78b79c1acfcd48769dda249e6d1c568ab83bdfde7c4a95b1d42caab1ffdb1.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4988

C:\PROGRA~3\Mozilla\uvqnnih.exe
C:\PROGRA~3\Mozilla\uvqnnih.exe -wdkdekj
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\uvqnnih.exe

Filesize
136KB

MD5
850b927223657de7abce53c16b8666d4

SHA1
795b55da1d5c6dcf069d48e5af5838dbb7dd54b3

SHA256
6e39d94564ba3d2a498db6870fa6e0762ab5deb1e17f014d51ba85fbd0f329fb

SHA512
ce60aca12aee5bf13c87aa8002f222e60ec7ecb29b4928b332784e7f48b6edcaa2fee2a9aec1f4f938425c8f192a2a3f200ce22d97ceb3c43a98e3bab038b923

Download Submit
memory/2996-11-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2996-12-0x0000000000C40000-0x0000000000C9B000-memory.dmp

Filesize
364KB

Download
memory/2996-18-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4988-0-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4988-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/4988-2-0x00000000020E0000-0x000000000213B000-memory.dmp

Filesize
364KB

Download
memory/4988-10-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download