b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9

Analysis

max time kernel
156s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 11:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
Size

5.3MB
MD5

a2d93b67cdb33cf24d9c3a24c6fb2e58
SHA1

3ad3b43a254af6270eddff32ed3ba88fdb677441
SHA256

b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9
SHA512

1b8a057a16fad324f0dd70d0d883d659b513acca5e1b03bfffb00dd4351646f7672101cb2f6695fb415718300071b5b046e5964dcf9fa9ca855f3bcab8e5b412
SSDEEP

98304:gZV7g+h1JCc+6MGIfQ6iWU0hVk6LzP8K4qWMivzgIeZ05k:UM21Q5pfQ6iohVtP86ivQx

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

mnzo.exemnzo.exelssvr.exemnzo.exe

pid process

2080 mnzo.exe
1944 mnzo.exe
1556 lssvr.exe
1356 mnzo.exe

pid	process
2080	mnzo.exe
1944	mnzo.exe
1556	lssvr.exe
1356	mnzo.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exemnzo.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	mnzo.exe

Loads dropped DLL 5 IoCs

Processes:

b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe

pid	process
3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe

Drops file in Program Files directory 10 IoCs

Processes:

b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe

description	ioc	process
File created	C:\Program Files (x86)\mnzo\AdbWinUsbApi.dll	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
File created	C:\Program Files (x86)\mnzo\ÃÀÅ®Ö÷²¥.lnk	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
File created	C:\Program Files (x86)\mnzo\mnzbd.exe	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
File created	C:\Program Files (x86)\mnzo\zbpn.exe	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
File created	C:\Program Files (x86)\mnzo\adb.exe	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
File created	C:\Program Files (x86)\mnzo\AdbWinApi.dll	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
File created	C:\Program Files (x86)\mnzo\mnzo.exe	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
File created	C:\Program Files (x86)\mnzo\lssvr.exe	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
File created	C:\Program Files (x86)\mnzo\aapt.exe	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
File created	C:\Program Files (x86)\mnzo\uninst.exe	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1864 taskkill.exe

pid	process
1864	taskkill.exe

Modifies registry class 2 IoCs

Processes:

mnzo.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	mnzo.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	mnzo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

lssvr.exe

pid process

1556 lssvr.exe
1556 lssvr.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1864 taskkill.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

mnzo.exe

pid process

1944 mnzo.exe
1944 mnzo.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

mnzo.exe

pid process

1944 mnzo.exe
1944 mnzo.exe
Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

mnzo.exemnzo.exelssvr.exemnzo.exe

pid process

2080 mnzo.exe
2080 mnzo.exe
1944 mnzo.exe
1944 mnzo.exe
1944 mnzo.exe
1944 mnzo.exe
1556 lssvr.exe
1356 mnzo.exe
1356 mnzo.exe

pid	process
1556	lssvr.exe
1556	lssvr.exe

description	pid	process
Token: SeDebugPrivilege	1864	taskkill.exe

pid	process
1944	mnzo.exe
1944	mnzo.exe

pid	process
1944	mnzo.exe
1944	mnzo.exe

pid	process
2080	mnzo.exe
2080	mnzo.exe
1944	mnzo.exe
1944	mnzo.exe
1944	mnzo.exe
1944	mnzo.exe
1556	lssvr.exe
1356	mnzo.exe
1356	mnzo.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe

description	pid	process	target process
PID 3364 wrote to memory of 2080	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	mnzo.exe
PID 3364 wrote to memory of 2080	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	mnzo.exe
PID 3364 wrote to memory of 2080	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	mnzo.exe
PID 3364 wrote to memory of 1864	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	taskkill.exe
PID 3364 wrote to memory of 1864	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	taskkill.exe
PID 3364 wrote to memory of 1864	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	taskkill.exe
PID 3364 wrote to memory of 1944	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	mnzo.exe
PID 3364 wrote to memory of 1944	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	mnzo.exe
PID 3364 wrote to memory of 1944	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	mnzo.exe
PID 3364 wrote to memory of 1356	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	mnzo.exe
PID 3364 wrote to memory of 1356	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	mnzo.exe
PID 3364 wrote to memory of 1356	3364	b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe	mnzo.exe

C:\Users\Admin\AppData\Local\Temp\b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe
"C:\Users\Admin\AppData\Local\Temp\b3bd3e9e7b9e0e9b453bf24c77f53696c976607f553ea67cd3c5e6f664adf6b9.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3364

C:\Users\Admin\AppData\Local\Temp\nsbCA7A.tmp\mnzo.exe
C:\Users\Admin\AppData\Local\Temp\nsbCA7A.tmp\mnzo.exe /fix
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2080

C:\Windows\SysWOW64\taskkill.exe
"C:\Windows\System32\taskkill.exe" /F /im mvyd.exe
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1864

C:\Program Files (x86)\mnzo\mnzo.exe
"C:\Program Files (x86)\mnzo\mnzo.exe" /setuprun
2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1944

C:\Program Files (x86)\mnzo\mnzo.exe
"C:\Program Files (x86)\mnzo\mnzo.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1356

C:\Program Files (x86)\mnzo\lssvr.exe
"C:\Program Files (x86)\mnzo\lssvr.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\mnzo\lssvr.exe

Filesize
777KB

MD5
b5c18fe7e8f457c1372cc81e514f405e

SHA1
aeb2b170b94ec661711c0c1a7d88a5f276e00be6

SHA256
3af3826491039e9b7f3db05c93217d9f29df87c42567d2b651c22c5ba1604eec

SHA512
16c1a2fc293c2c980d758932656f5995a9c06f970f68422afbf91618447559e36df99dada3ce8813e362c1c71e5fe6715423a42c70b52d8e9714ca32fb720ac5

Download Submit
C:\Program Files (x86)\mnzo\lssvr.exe

Filesize
777KB

MD5
b5c18fe7e8f457c1372cc81e514f405e

SHA1
aeb2b170b94ec661711c0c1a7d88a5f276e00be6

SHA256
3af3826491039e9b7f3db05c93217d9f29df87c42567d2b651c22c5ba1604eec

SHA512
16c1a2fc293c2c980d758932656f5995a9c06f970f68422afbf91618447559e36df99dada3ce8813e362c1c71e5fe6715423a42c70b52d8e9714ca32fb720ac5

Download Submit
C:\Program Files (x86)\mnzo\mnzo.exe

Filesize
2.0MB

MD5
3cc53c172a96e9657ecedabf5354f24c

SHA1
0ddf19214a8017747ab3a6c71f0f22133bb0bc73

SHA256
a32aeee50ec1f4dfe7f1fc80417d2159d90d1bbe59d5929b10dfda0d4255f866

SHA512
a50d1e31e2ff82c2a2188b7f9ba1d3c5218fff25c6da1bb376e9a550c7df3c0765dbc5a2dc6c274711fa1471050ab78ee118194730f4fce3872cbe2367b941d4

Download Submit
C:\Program Files (x86)\mnzo\mnzo.exe

Filesize
2.0MB

MD5
3cc53c172a96e9657ecedabf5354f24c

SHA1
0ddf19214a8017747ab3a6c71f0f22133bb0bc73

SHA256
a32aeee50ec1f4dfe7f1fc80417d2159d90d1bbe59d5929b10dfda0d4255f866

SHA512
a50d1e31e2ff82c2a2188b7f9ba1d3c5218fff25c6da1bb376e9a550c7df3c0765dbc5a2dc6c274711fa1471050ab78ee118194730f4fce3872cbe2367b941d4

Download Submit
C:\Program Files (x86)\mnzo\mnzo.exe

Filesize
2.0MB

MD5
3cc53c172a96e9657ecedabf5354f24c

SHA1
0ddf19214a8017747ab3a6c71f0f22133bb0bc73

SHA256
a32aeee50ec1f4dfe7f1fc80417d2159d90d1bbe59d5929b10dfda0d4255f866

SHA512
a50d1e31e2ff82c2a2188b7f9ba1d3c5218fff25c6da1bb376e9a550c7df3c0765dbc5a2dc6c274711fa1471050ab78ee118194730f4fce3872cbe2367b941d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbCA7A.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbCA7A.tmp\mnzo.exe

Filesize
2.0MB

MD5
3cc53c172a96e9657ecedabf5354f24c

SHA1
0ddf19214a8017747ab3a6c71f0f22133bb0bc73

SHA256
a32aeee50ec1f4dfe7f1fc80417d2159d90d1bbe59d5929b10dfda0d4255f866

SHA512
a50d1e31e2ff82c2a2188b7f9ba1d3c5218fff25c6da1bb376e9a550c7df3c0765dbc5a2dc6c274711fa1471050ab78ee118194730f4fce3872cbe2367b941d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbCA7A.tmp\mnzo.exe

Filesize
2.0MB

MD5
3cc53c172a96e9657ecedabf5354f24c

SHA1
0ddf19214a8017747ab3a6c71f0f22133bb0bc73

SHA256
a32aeee50ec1f4dfe7f1fc80417d2159d90d1bbe59d5929b10dfda0d4255f866

SHA512
a50d1e31e2ff82c2a2188b7f9ba1d3c5218fff25c6da1bb376e9a550c7df3c0765dbc5a2dc6c274711fa1471050ab78ee118194730f4fce3872cbe2367b941d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbCA7A.tmp\nsSCM.dll

Filesize
5KB

MD5
62efa7b730eb0523a026ea4325403b77

SHA1
806ed3bd677ccf5d9817c9b464015e347f2c8f3c

SHA256
0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38

SHA512
748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbCA7A.tmp\nsSCM.dll

Filesize
5KB

MD5
62efa7b730eb0523a026ea4325403b77

SHA1
806ed3bd677ccf5d9817c9b464015e347f2c8f3c

SHA256
0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38

SHA512
748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbCA7A.tmp\nsSCM.dll

Filesize
5KB

MD5
62efa7b730eb0523a026ea4325403b77

SHA1
806ed3bd677ccf5d9817c9b464015e347f2c8f3c

SHA256
0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38

SHA512
748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsbCA7A.tmp\nsSCM.dll

Filesize
5KB

MD5
62efa7b730eb0523a026ea4325403b77

SHA1
806ed3bd677ccf5d9817c9b464015e347f2c8f3c

SHA256
0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38

SHA512
748237582e1c25655cf512ec6b1a2f9ad59b3a0da2c3cada535f202dcc66e068ab3bb3be34016f944a4a4fae71a16aea12f9725fe9f679b3fd1073639e31033b

Download Submit
memory/1356-147-0x0000000000000000-mapping.dmp

Download
memory/1864-139-0x0000000000000000-mapping.dmp

Download
memory/1944-142-0x0000000000000000-mapping.dmp

Download
memory/2080-134-0x0000000000000000-mapping.dmp

Download