65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31

Analysis

max time kernel
186s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 04:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Size

76KB
MD5

6be443c66777a97dc834ad449ff19e80
SHA1

5bdc9b58faddbf124fb0f7ba08f1251788a03a49
SHA256

65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31
SHA512

6a4b41a4eb413e2e52875f5139c1f2d9ac110ef5a1ed59dac48976ab9e56febe33efb7c6dd9e14fccd4f44d5bf2b4198f1323c812c80b5fea421cc0426f8876e
SSDEEP

768:iembNRqsuhlGOBrhgFwumSCbxTGy/BBGg4NKJJKqUThbJ32+ve7i40vN0TlT+Xkn:Qnqdu3abBGy3G8V0iuoKy

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	iznw.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	iznw.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	iznw.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe

Executes dropped EXE 1 IoCs

pid	Process
4924	iznw.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm"	iznw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	iznw.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	iznw.exe
File opened (read-only)	\??\N:	iznw.exe
File opened (read-only)	\??\O:	iznw.exe
File opened (read-only)	\??\P:	iznw.exe
File opened (read-only)	\??\R:	iznw.exe
File opened (read-only)	\??\T:	iznw.exe
File opened (read-only)	\??\I:	iznw.exe
File opened (read-only)	\??\F:	iznw.exe
File opened (read-only)	\??\H:	iznw.exe
File opened (read-only)	\??\S:	iznw.exe
File opened (read-only)	\??\Y:	iznw.exe
File opened (read-only)	\??\B:	iznw.exe
File opened (read-only)	\??\U:	iznw.exe
File opened (read-only)	\??\V:	iznw.exe
File opened (read-only)	\??\W:	iznw.exe
File opened (read-only)	\??\X:	iznw.exe
File opened (read-only)	\??\Q:	iznw.exe
File opened (read-only)	\??\G:	iznw.exe
File opened (read-only)	\??\J:	iznw.exe
File opened (read-only)	\??\K:	iznw.exe
File opened (read-only)	\??\L:	iznw.exe
File opened (read-only)	\??\Z:	iznw.exe
File opened (read-only)	\??\E:	iznw.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\maxtrox.txt	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
File created	\??\c:\windows\SysWOW64\Windows 3D.scr	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
File opened for modification	\??\c:\windows\SysWOW64\maxtrox.txt	iznw.exe
File opened for modification	\??\c:\windows\SysWOW64\Windows 3D.scr	iznw.exe
File created	\??\c:\windows\SysWOW64\Desktop.sysm	iznw.exe
File created	\??\c:\windows\SysWOW64\CommandPrompt.Sysm	iznw.exe

Drops file in Program Files directory 27 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Internet Explorer\ielowutil.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\firefox.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmlaunch.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpshare.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Windows Mail\wabmig.exe	iznw.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iexplore.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmplayer.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnetwk.exe	iznw.exe
File opened for modification	\??\c:\Program Files\7-Zip\7z.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\iediagcmd.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmprph.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Internet Explorer\ieinstal.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\updater.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpconfig.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\wmpnscfg.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\pingsender.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-container.exe	iznw.exe
File opened for modification	\??\c:\Program Files\7-Zip\Uninstall.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\setup_wm.exe	iznw.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.exe	iznw.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe	iznw.exe

Modifies registry class 36 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	iznw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	iznw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	iznw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1"	iznw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic"	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	iznw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	iznw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	iznw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt	iznw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon	iznw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command	iznw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	iznw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	iznw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	iznw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt	iznw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct"	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe"	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1"	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt	iznw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe"	iznw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3320	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
4924	iznw.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4924	3320	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe	81
PID 3320 wrote to memory of 4924	3320	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe	81
PID 3320 wrote to memory of 4924	3320	65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe	81

C:\Users\Admin\AppData\Local\Temp\65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe
"C:\Users\Admin\AppData\Local\Temp\65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31.exe"
1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3320
- \??\c:\Documents and Settings\Admin\Application Data\Microsoft\iznw.exe
  "c:\Documents and Settings\Admin\Application Data\Microsoft\iznw.exe" 65b511e4f48b2b6df0ea2767084814daf9645cd15be7eda78985f01cc2422e31
  2⤵
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\iznw.exe

Filesize
76KB

MD5
6c7a34dc526abd9ae2d22d96c4d4e579

SHA1
311122284e711cdbdd94d7d66eed586988ccd4b4

SHA256
65a7811df788994aeb09f3e0c8e4e44bc4a53eb58f63c9a2fd06956327d537d5

SHA512
de5003f3cb0a3d3cb8872b0047478d1676a2ecff9d0a86987001750e3cb2f9f136aecd22f3f2dbf5035872de28f6dc0f238543a15a476192baf355a2997ffd63

Download Submit
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\iznw.exe

Filesize
76KB

MD5
6c7a34dc526abd9ae2d22d96c4d4e579

SHA1
311122284e711cdbdd94d7d66eed586988ccd4b4

SHA256
65a7811df788994aeb09f3e0c8e4e44bc4a53eb58f63c9a2fd06956327d537d5

SHA512
de5003f3cb0a3d3cb8872b0047478d1676a2ecff9d0a86987001750e3cb2f9f136aecd22f3f2dbf5035872de28f6dc0f238543a15a476192baf355a2997ffd63

Download Submit
\??\c:\windows\SysWOW64\maxtrox.txt

Filesize
8B

MD5
24865ca220aa1936cbac0a57685217c5

SHA1
37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

SHA256
841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

SHA512
c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads