Analysis
- max time kernel
91s - max time network
182s - platform
windows10-ltsc 2021_x64 - resource
win10ltsc2021-20250207-en - resource tags
- submitted
10/02/2025, 04:34
General
- Target VirusSign.2023.11.29/047c7fed39ef255fecdd70e9a870ae19.exe
- Size 201KB
- Sample250210-e7c5na1qhs
- SHA256 66cdae03bb8c51a27b91bfe1d9050ced4e460187e24b0e57a1c293ee0ed7d31e
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Drops file in Program Files directory 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusSign.2023.11.29\047c7fed39ef255fecdd70e9a870ae19.exe"C:\Users\Admin\AppData\Local\Temp\VirusSign.2023.11.29\047c7fed39ef255fecdd70e9a870ae19.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\PROGRA~3\Mozilla\kwforzi.exe"C:\PROGRA~3\Mozilla\kwforzi.exe" -dawiryc1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjZFOTFEQzUtQUNFRC00QTI4LUFDRkItN0EwN0E5MDZBODJBfSIgdXNlcmlkPSJ7OTU2MDI1MTgtMDJFRC00RTEyLUI5ODctRjQ3ODhGOUU1NDBGfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDZCMkRCOTktM0RENy00NDU4LTlBNzUtNEM2RjVBQ0IxOEU4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NC40NTI5IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iMTI1IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMjMuMC42MzEyLjEyMyIgbmV4dHZlcnNpb249IiIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMiIgaW5zdGFsbGRhdGV0aW1lPSIxNzM4OTM1NTAwIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODM0MDgwNDYzMTQwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTQzNzY4NjQ3NyIvPjwvYXBwPjwvcmVxdWVzdD41⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
kwforzi.exe
lksxdrg.dll
memory/3832-17-0x0000000010000000-0x0000000010016000-memory.dmp
memory/3832-19-0x0000000000EC0000-0x0000000000ED6000-memory.dmp
memory/3832-20-0x0000000000EC0000-0x0000000000ED6000-memory.dmp
memory/3832-18-0x0000000000820000-0x0000000000836000-memory.dmp
memory/3936-8-0x0000000000400000-0x000000000045E000-memory.dmp
memory/3936-9-0x0000000000400000-0x000000000045E000-memory.dmp
memory/3936-11-0x0000000000400000-0x000000000045B000-memory.dmp
memory/5096-2-0x0000000000400000-0x000000000045B000-memory.dmp
memory/5096-6-0x0000000000400000-0x000000000045B000-memory.dmp
memory/5096-1-0x00000000005E0000-0x000000000063B000-memory.dmp
memory/5096-0-0x0000000000400000-0x000000000045E000-memory.dmp