Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-10-2022 16:22
Static task
static1
Behavioral task
behavioral1
Sample
3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe
-
Size
164KB
-
MD5
8367df12ca0e91d399cf8330da83b2b0
-
SHA1
f0ed3c4f8ef2d9cc528eb51ab6c09c34cb16e53b
-
SHA256
3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e
-
SHA512
6c56751c457db0e9f8ce4b386d3e0154b26f20f974485ab3e936e457b5456043c1505082e8fef051e087f51e4eb0e62d92ed3fb019df9b3d55799121a68e29b2
-
SSDEEP
3072:9sWcISlDP6veiCi36JRbs4jwKWuRr6TQY3vaFJ0T72mBT:9sWcIMDP6mJDjwZuesY3CFJ0T72uT
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lzlaic.exe -
Executes dropped EXE 1 IoCs
pid Process 820 lzlaic.exe -
Loads dropped DLL 2 IoCs
pid Process 1268 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe 1268 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /x" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /b" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /k" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /m" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /p" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /w" lzlaic.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /y" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /e" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /d" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /n" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /v" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /l" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /u" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /q" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /o" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /c" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /i" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /a" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /j" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /s" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /z" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /h" lzlaic.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /r" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /f" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /s" 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /t" lzlaic.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\lzlaic = "C:\\Users\\Admin\\lzlaic.exe /g" lzlaic.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1268 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe 820 lzlaic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1268 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe 820 lzlaic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1268 wrote to memory of 820 1268 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe 27 PID 1268 wrote to memory of 820 1268 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe 27 PID 1268 wrote to memory of 820 1268 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe 27 PID 1268 wrote to memory of 820 1268 3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe"C:\Users\Admin\AppData\Local\Temp\3c52a9c4d62fb0c5f1a979079c7cfbfb6fc14df4d39103e05505f505ab57779e.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\lzlaic.exe"C:\Users\Admin\lzlaic.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:820
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD58f766e1fc2c9c89173fba1f334c5504a
SHA1f15094b3b4782967c188bfc0913bd45472912e8a
SHA2566a786b677f41a31bffd3eaaa4b4b33e09c475727eba2b305ef81ccda06406771
SHA5127315ea5b6938d7b2a8bc8ca778d67559618038056f0b4dcec9413077895d833d2f1ae60b51ee20ad879afce5dba27a32ea0009c57e28cf4a0fafe05e2d7a8abe
-
Filesize
164KB
MD58f766e1fc2c9c89173fba1f334c5504a
SHA1f15094b3b4782967c188bfc0913bd45472912e8a
SHA2566a786b677f41a31bffd3eaaa4b4b33e09c475727eba2b305ef81ccda06406771
SHA5127315ea5b6938d7b2a8bc8ca778d67559618038056f0b4dcec9413077895d833d2f1ae60b51ee20ad879afce5dba27a32ea0009c57e28cf4a0fafe05e2d7a8abe
-
Filesize
164KB
MD58f766e1fc2c9c89173fba1f334c5504a
SHA1f15094b3b4782967c188bfc0913bd45472912e8a
SHA2566a786b677f41a31bffd3eaaa4b4b33e09c475727eba2b305ef81ccda06406771
SHA5127315ea5b6938d7b2a8bc8ca778d67559618038056f0b4dcec9413077895d833d2f1ae60b51ee20ad879afce5dba27a32ea0009c57e28cf4a0fafe05e2d7a8abe
-
Filesize
164KB
MD58f766e1fc2c9c89173fba1f334c5504a
SHA1f15094b3b4782967c188bfc0913bd45472912e8a
SHA2566a786b677f41a31bffd3eaaa4b4b33e09c475727eba2b305ef81ccda06406771
SHA5127315ea5b6938d7b2a8bc8ca778d67559618038056f0b4dcec9413077895d833d2f1ae60b51ee20ad879afce5dba27a32ea0009c57e28cf4a0fafe05e2d7a8abe