Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 10:41
Static task
static1
Behavioral task
behavioral1
Sample
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe
Resource
win10v2004-20220812-en
General
-
Target
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe
-
Size
76KB
-
MD5
18618f5c00b81d0262ee04dc3233a207
-
SHA1
242a4334449a69b4deb24b6149e30a43a2998197
-
SHA256
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c
-
SHA512
0acd8f2be884c15e2f9c30caae73d7f7981ef4c03b08e2b23090a74c4e592ecbf534e954ddc02887311adb8005ebc696e4e2ab7fa6ac1c5567602afabb51c293
-
SSDEEP
768:sembNRqsuhlGOBrhgFwumSCbxTGy/BBGg41KJJKqUThbJ32+ve7i40vN0TlT+Xkq:mnqdu3abBGy3GEV0iuo2X
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 2 IoCs
Processes:
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exeizap.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt izap.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs
Processes:
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exeizap.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" izap.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exeizap.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" izap.exe -
Executes dropped EXE 1 IoCs
Processes:
izap.exepid process 1704 izap.exe -
Loads dropped DLL 2 IoCs
Processes:
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exepid process 1000 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe 1000 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
izap.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run izap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VisualStyle = "c:\\windows\\system32\\Desktop.sysm" izap.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
izap.exedescription ioc process File opened (read-only) \??\N: izap.exe File opened (read-only) \??\R: izap.exe File opened (read-only) \??\U: izap.exe File opened (read-only) \??\B: izap.exe File opened (read-only) \??\E: izap.exe File opened (read-only) \??\J: izap.exe File opened (read-only) \??\L: izap.exe File opened (read-only) \??\M: izap.exe File opened (read-only) \??\W: izap.exe File opened (read-only) \??\X: izap.exe File opened (read-only) \??\Z: izap.exe File opened (read-only) \??\F: izap.exe File opened (read-only) \??\I: izap.exe File opened (read-only) \??\P: izap.exe File opened (read-only) \??\K: izap.exe File opened (read-only) \??\S: izap.exe File opened (read-only) \??\T: izap.exe File opened (read-only) \??\V: izap.exe File opened (read-only) \??\Y: izap.exe File opened (read-only) \??\G: izap.exe File opened (read-only) \??\H: izap.exe File opened (read-only) \??\O: izap.exe File opened (read-only) \??\Q: izap.exe -
Drops file in System32 directory 6 IoCs
Processes:
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exeizap.exedescription ioc process File created \??\c:\windows\SysWOW64\maxtrox.txt 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe File created \??\c:\windows\SysWOW64\Windows 3D.scr 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe File opened for modification \??\c:\windows\SysWOW64\maxtrox.txt izap.exe File opened for modification \??\c:\windows\SysWOW64\Windows 3D.scr izap.exe File created \??\c:\windows\SysWOW64\Desktop.sysm izap.exe File created \??\c:\windows\SysWOW64\CommandPrompt.Sysm izap.exe -
Drops file in Program Files directory 34 IoCs
Processes:
izap.exedescription ioc process File opened for modification \??\c:\Program Files\Windows Media Player\WMPSideShowGadget.exe izap.exe File opened for modification \??\c:\Program Files\7-Zip\7zG.exe izap.exe File opened for modification \??\c:\Program Files\7-Zip\Uninstall.exe izap.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-hang-ui.exe izap.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmplayer.exe izap.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmprph.exe izap.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpshare.exe izap.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\firefox.exe izap.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe izap.exe File opened for modification \??\c:\Program Files\Windows Mail\wabmig.exe izap.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpconfig.exe izap.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnetwk.exe izap.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\crashreporter.exe izap.exe File opened for modification \??\c:\Program Files\Windows Defender\MSASCui.exe izap.exe File opened for modification \??\c:\Program Files\Windows Media Player\WMPDMC.exe izap.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpenc.exe izap.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmpnscfg.exe izap.exe File opened for modification \??\c:\Program Files\Internet Explorer\ielowutil.exe izap.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\minidump-analyzer.exe izap.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\pingsender.exe izap.exe File opened for modification \??\c:\Program Files\Internet Explorer\iexplore.exe izap.exe File opened for modification \??\c:\Program Files\Windows Defender\MpCmdRun.exe izap.exe File opened for modification \??\c:\Program Files\Windows Media Player\wmlaunch.exe izap.exe File opened for modification \??\c:\Program Files\Windows Sidebar\sidebar.exe izap.exe File opened for modification \??\c:\Program Files\7-Zip\7z.exe izap.exe File opened for modification \??\c:\Program Files\Internet Explorer\ieinstal.exe izap.exe File opened for modification \??\c:\Program Files\Windows Journal\PDIALOG.exe izap.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\updater.exe izap.exe File opened for modification \??\c:\Program Files\Windows Mail\wab.exe izap.exe File opened for modification \??\c:\Program Files\7-Zip\7zFM.exe izap.exe File opened for modification \??\c:\Program Files\Internet Explorer\iediagcmd.exe izap.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\default-browser-agent.exe izap.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe izap.exe File opened for modification \??\c:\Program Files\Mozilla Firefox\plugin-container.exe izap.exe -
Modifies registry class 36 IoCs
Processes:
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exeizap.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe" 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1" 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic" 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe" izap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct" 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command izap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt izap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon\ = "c:\\windows\\SysWow64\\rasphone.exe" izap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command izap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm izap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1" izap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd izap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\ = "Microsoft System Direct" izap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\DefaultIcon izap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command\ = "%1" izap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open\Command 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell\Open 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\NeverShowExt izap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon izap.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\Shell 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell\Open\Command\ = "%1" 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile izap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\DefaultIcon\ = "c:\\windows\\SysWow64\\netsetup.exe" 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\Shell 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Msd\NeverShowExt izap.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sysm\ = "System Mechanic" izap.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exeizap.exepid process 1000 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe 1704 izap.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exedescription pid process target process PID 1000 wrote to memory of 1704 1000 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe izap.exe PID 1000 wrote to memory of 1704 1000 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe izap.exe PID 1000 wrote to memory of 1704 1000 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe izap.exe PID 1000 wrote to memory of 1704 1000 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe izap.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe"C:\Users\Admin\AppData\Local\Temp\19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c.exe"1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\izap.exe"c:\Documents and Settings\Admin\Application Data\Microsoft\izap.exe" 19f7c22ea40b583468d54b91e3965b79269605c077410180b792d0b980a7578c2⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\izap.exeFilesize
76KB
MD5a15f316eb632dde2f506a3911ca55862
SHA138f6fb5da7ab433867cbd08600dec67b7dda1d6c
SHA256645284d68aef58a2f04ac060044cb016c1c879e1a9945c76a99fda7acab11299
SHA512df3a5d3b77a085530c371ae12bb1135d854997fd036b129f543159c70fdb4e2e2c2ed6a73252ca84a7589ccae64c46bf8cdd31346296bf62caa8d965cc0b53ce
-
\??\c:\Documents and Settings\Admin\Application Data\Microsoft\izap.exeFilesize
76KB
MD5a15f316eb632dde2f506a3911ca55862
SHA138f6fb5da7ab433867cbd08600dec67b7dda1d6c
SHA256645284d68aef58a2f04ac060044cb016c1c879e1a9945c76a99fda7acab11299
SHA512df3a5d3b77a085530c371ae12bb1135d854997fd036b129f543159c70fdb4e2e2c2ed6a73252ca84a7589ccae64c46bf8cdd31346296bf62caa8d965cc0b53ce
-
\??\c:\windows\SysWOW64\Windows 3D.scrFilesize
76KB
MD5152c7d017260fa0747f59ceb2164a94c
SHA172b3a771fdf9c001d780e399b818a22ccb6960bb
SHA2566734ce7bf5b39366f8091c403bcfd4a8519895df0ea49d02f60f2c361384f781
SHA512179effef70c6e4d48cf75917d9e10e0067febfe52a10938a7acb6e18838ab2d022c49b2bda98a306a84163f733005710a61201bde9e2e9acf52e76d1f0d7a392
-
\??\c:\windows\SysWOW64\maxtrox.txtFilesize
8B
MD524865ca220aa1936cbac0a57685217c5
SHA137f687cafe79e91eae6cbdffbf2f7ad3975f5e83
SHA256841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743
SHA512c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062
-
\Users\Admin\AppData\Roaming\Microsoft\izap.exeFilesize
76KB
MD5a15f316eb632dde2f506a3911ca55862
SHA138f6fb5da7ab433867cbd08600dec67b7dda1d6c
SHA256645284d68aef58a2f04ac060044cb016c1c879e1a9945c76a99fda7acab11299
SHA512df3a5d3b77a085530c371ae12bb1135d854997fd036b129f543159c70fdb4e2e2c2ed6a73252ca84a7589ccae64c46bf8cdd31346296bf62caa8d965cc0b53ce
-
\Users\Admin\AppData\Roaming\Microsoft\izap.exeFilesize
76KB
MD5a15f316eb632dde2f506a3911ca55862
SHA138f6fb5da7ab433867cbd08600dec67b7dda1d6c
SHA256645284d68aef58a2f04ac060044cb016c1c879e1a9945c76a99fda7acab11299
SHA512df3a5d3b77a085530c371ae12bb1135d854997fd036b129f543159c70fdb4e2e2c2ed6a73252ca84a7589ccae64c46bf8cdd31346296bf62caa8d965cc0b53ce
-
memory/1704-58-0x0000000000000000-mapping.dmp