Analysis
-
max time kernel
232s -
max time network
201s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
24-11-2022 21:44
Static task
static1
Behavioral task
behavioral1
Sample
7z21.03-zstd-x64.exe
Resource
win10-20220901-en
General
-
Target
7z21.03-zstd-x64.exe
-
Size
2.7MB
-
MD5
f755b434e5648f9f2c42102a04da6d3b
-
SHA1
e4fd50ded0f6cbaa4f1f035c95ec6daea13b93b8
-
SHA256
531b20dfb03d8f30f61ae56a181610bbb6f3cf7cc71dac1d8f95511289de76f3
-
SHA512
8aedcbc1076efe73ef43c4f33bc971c93fbb2d9d733232e4ec16ab90082e9dd77360c880fbe67f60e50c24faf6263458491cae4dd99038fbddbcf919d9a18e7c
-
SSDEEP
49152:c3/Vrv2V0ghd8New+nGeiUDtnTjEuaTfOyeIkHhzKcRWSJHMsIBC7pgvxlX7Sauk:a1vm8MTn/TTjEr7OyeIkpKcRxJsFHlt5
Malware Config
Extracted
C:\Program Files\7-Zip-Zstandard\History.txt
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
7zG.exe7zG.exepid process 4996 7zG.exe 4412 7zG.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
7z21.03-zstd-x64.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip-Zstandard\\7-zip.dll" 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z21.03-zstd-x64.exe -
Loads dropped DLL 3 IoCs
Processes:
7zG.exe7zG.exepid process 2588 4996 7zG.exe 4412 7zG.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
Processes:
7z21.03-zstd-x64.exedescription ioc process File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\nb.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\7zCon.sfx 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\bn.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\cs.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\lij.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\mng2.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\mr.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\sr-spl.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\uk.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\7z.dll 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\az.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\ga.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\gl.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\hi.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\nl.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\uz.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\tr.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\io.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\kab.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\mk.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\7zG.exe 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\fa.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\gu.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\zh-tw.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\readme.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\pl.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\ca.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\eu.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\sv.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\ku.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\lt.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\7za.exe 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\hr.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\it.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\it.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\pt.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\si.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\ug.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\zh-cn.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\sa.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\sk.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\descript.ion 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\fi.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\hy.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\7zxa.dll 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\kaa.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\va.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\readme.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\es.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\hu.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\ka.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\sk.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\th.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\ug.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\tt.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\zh-tw.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\7-zip.chm 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\an.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\ba.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\et.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\ku-ckb.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\sq.txt 7z21.03-zstd-x64.exe File created C:\Program Files\7-Zip-Zstandard\Lang\ne.txt 7z21.03-zstd-x64.exe File opened for modification C:\Program Files\7-Zip-Zstandard\Lang\ro.txt 7z21.03-zstd-x64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 20 IoCs
Processes:
7z21.03-zstd-x64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip-Zstandard\\7-zip32.dll" 7z21.03-zstd-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000} 7z21.03-zstd-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip-Zstandard 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip-Zstandard\ = "{23170F69-20BB-278A-1000-000100020000}" 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip-Zstandard\ = "{23170F69-20BB-278A-1000-000100020000}" 7z21.03-zstd-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip-Zstandard\\7-zip.dll" 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip-Zstandard\ = "{23170F69-20BB-278A-1000-000100020000}" 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-20BB-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z21.03-zstd-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip-Zstandard\ = "{23170F69-20BB-278A-1000-000100020000}" 7z21.03-zstd-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip-Zstandard 7z21.03-zstd-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip-Zstandard 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip-Zstandard\ = "{23170F69-20BB-278A-1000-000100020000}" 7z21.03-zstd-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip-Zstandard 7z21.03-zstd-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-20BB-278A-1000-000100020000} 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z21.03-zstd-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-20BB-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z21.03-zstd-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip-Zstandard 7z21.03-zstd-x64.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
7zG.exe7zG.exesvchost.exe7zG.exedescription pid process Token: SeRestorePrivilege 3564 7zG.exe Token: 35 3564 7zG.exe Token: SeSecurityPrivilege 3564 7zG.exe Token: SeSecurityPrivilege 3564 7zG.exe Token: SeRestorePrivilege 4996 7zG.exe Token: 35 4996 7zG.exe Token: SeSecurityPrivilege 4996 7zG.exe Token: SeSecurityPrivilege 4996 7zG.exe Token: SeTcbPrivilege 4120 svchost.exe Token: SeRestorePrivilege 4120 svchost.exe Token: SeRestorePrivilege 4412 7zG.exe Token: 35 4412 7zG.exe Token: SeSecurityPrivilege 4412 7zG.exe Token: SeSecurityPrivilege 4412 7zG.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
7zG.exe7zG.exe7zG.exepid process 3564 7zG.exe 4996 7zG.exe 4412 7zG.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
svchost.exedescription pid process target process PID 4120 wrote to memory of 2880 4120 svchost.exe dashost.exe PID 4120 wrote to memory of 2880 4120 svchost.exe dashost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7z21.03-zstd-x64.exe"C:\Users\Admin\AppData\Local\Temp\7z21.03-zstd-x64.exe"1⤵
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap9907:636:7zEvent29543 -ad -saa -- "C:\Users\Admin\Desktop\Desktop"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\7-Zip-Zstandard\7zG.exe"C:\Program Files\7-Zip-Zstandard\7zG.exe" a -i#7zMap13635:636:7zEvent17613 -ad -saa -- "C:\Users\Admin\Desktop\Desktop"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dashost.exedashost.exe {c88ca3a7-52c9-4e1d-abba3a8bcbf46c85}2⤵
-
C:\Program Files\7-Zip-Zstandard\7zG.exe"C:\Program Files\7-Zip-Zstandard\7zG.exe" a -i#7zMap28379:2046:7zEvent23329 -ad -saa -- "C:\Users\Admin\Desktop\Desktop"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\7-Zip-Zstandard\7z.dllFilesize
4.0MB
MD55c27dfa0870cbc7734fa981c876a5898
SHA147e532a2ff3c0228f07191ef3280e1342151e9ce
SHA256931046f66e5dd876122f9cb1951c1d2cdbf7bde69af7e87cfd63319ac0689c17
SHA51293228f6fb67883aa7d37d7164dfb643d7d178868061741dcaffa0af97b978ebfb9c2cba8ab1eed5ccf0fb466e38ac06a063316a6b5fc802b1dabde5b06b351cb
-
C:\Program Files\7-Zip-Zstandard\7zG.exeFilesize
533KB
MD54de6b2b720b471f07dc1aeabadadecc6
SHA1f2d28dec305a9b3001835e7582b492d90c7c0f18
SHA25648ee1445739d2687b78c9e315edfe4b795460646496c60356e2c251f7ccf4f47
SHA5120de3258d8a798d0439af95f08b74af0868e8c135ce81935e446fa7ef2acaa26c39c0f1c2f88e1b3ab74fdfdd3f23e0509eb12b5342b4334d871aeb5916672f43
-
C:\Program Files\7-Zip-Zstandard\7zG.exeFilesize
533KB
MD54de6b2b720b471f07dc1aeabadadecc6
SHA1f2d28dec305a9b3001835e7582b492d90c7c0f18
SHA25648ee1445739d2687b78c9e315edfe4b795460646496c60356e2c251f7ccf4f47
SHA5120de3258d8a798d0439af95f08b74af0868e8c135ce81935e446fa7ef2acaa26c39c0f1c2f88e1b3ab74fdfdd3f23e0509eb12b5342b4334d871aeb5916672f43
-
C:\Users\Admin\Desktop\Desktop.7zFilesize
5.9MB
MD50502b722ccde2897dded38eee8d4d0ca
SHA1635b59827b5222d5cb2140a80464ad8233f2ba29
SHA256274c741aa15077f52155da4b470e6355795caeaaf5e063dbe248b87fc562c33e
SHA512593cb7081f14017ef41f1fe5d58bda056bc2632a262fb4a74421a4f9764c3691432a4874ab8f736360ea9ca1e705533b5adbbc60053e1d13465625bd983d5077
-
C:\Users\Admin\Desktop\Desktop.zipFilesize
5.8MB
MD58e205f5b44236afd99e41664c6aa56a7
SHA190db3905c8e0d9d8792276791ed6da56d0442149
SHA256e4389628a6b771e9f3f71101b134a65607ea619f3d87fa9099a68ce582bf0b42
SHA5129b48ab294a5d416475527a2cc747984d6630d4ee6e00e6babb900fde27ddbed970a2da61d70aa3cf7dc783c00cf8bfe03c5fd42d9d0920714941f8ba4d6f24c5
-
\Program Files\7-Zip-Zstandard\7-zip.dllFilesize
160KB
MD5e251bcc7602ade13aa4c8c0f6e0c0baa
SHA1ecb66acf271c99a951f40f48e8655b52522ee9f6
SHA256a2907f7ad8067d0f3b419e1fd3639c825f82339a3ec17e40e159dfe66f63c90c
SHA512a19b28a02a654625a5e176cb4884fea48ebcb922f1dab7bc1f95795fa60436e46f9fe086504fa382acb42d25cbbef7e684d1b6ecc3bddea4682297de08b56ea4
-
\Program Files\7-Zip-Zstandard\7z.dllFilesize
4.0MB
MD55c27dfa0870cbc7734fa981c876a5898
SHA147e532a2ff3c0228f07191ef3280e1342151e9ce
SHA256931046f66e5dd876122f9cb1951c1d2cdbf7bde69af7e87cfd63319ac0689c17
SHA51293228f6fb67883aa7d37d7164dfb643d7d178868061741dcaffa0af97b978ebfb9c2cba8ab1eed5ccf0fb466e38ac06a063316a6b5fc802b1dabde5b06b351cb
-
\Program Files\7-Zip-Zstandard\7z.dllFilesize
4.0MB
MD55c27dfa0870cbc7734fa981c876a5898
SHA147e532a2ff3c0228f07191ef3280e1342151e9ce
SHA256931046f66e5dd876122f9cb1951c1d2cdbf7bde69af7e87cfd63319ac0689c17
SHA51293228f6fb67883aa7d37d7164dfb643d7d178868061741dcaffa0af97b978ebfb9c2cba8ab1eed5ccf0fb466e38ac06a063316a6b5fc802b1dabde5b06b351cb
-
memory/2880-123-0x0000000000000000-mapping.dmp