Analysis
-
max time kernel
132s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:17
Static task
static1
Behavioral task
behavioral1
Sample
a997f627b9d789ee2bb5700a9f58eba81081e1ea376dc159195d91354d8fc61c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a997f627b9d789ee2bb5700a9f58eba81081e1ea376dc159195d91354d8fc61c.exe
Resource
win10v2004-20220812-en
General
-
Target
a997f627b9d789ee2bb5700a9f58eba81081e1ea376dc159195d91354d8fc61c.exe
-
Size
240KB
-
MD5
12819fe1e2657c2fde9c027ec2fa6b85
-
SHA1
e2b2150c8214c268abbc4dbe71c776190d490bc9
-
SHA256
a997f627b9d789ee2bb5700a9f58eba81081e1ea376dc159195d91354d8fc61c
-
SHA512
1dbd5239b559719a4ad438a279653ed1fcb0d9887834842c6f6d88d5ef1ab98e6609e7a31b58e42b392a9937c42317161686fb041372b17a349be724c55d533b
-
SSDEEP
6144:A+J0Q1PdsbZTHY8Yu3uD2ETjjfoQ7wVqQ3fn8zMHjjCmowyzZDnZ:AaX2HV3wjjfoQ7wVqQ/DjJ1yzJnZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
gzczynd.exepid process 556 gzczynd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a997f627b9d789ee2bb5700a9f58eba81081e1ea376dc159195d91354d8fc61c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\8B3337FC = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gzczynd.exe" a997f627b9d789ee2bb5700a9f58eba81081e1ea376dc159195d91354d8fc61c.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
gzczynd.exedescription ioc process File opened (read-only) \??\E: gzczynd.exe File opened (read-only) \??\K: gzczynd.exe File opened (read-only) \??\S: gzczynd.exe File opened (read-only) \??\V: gzczynd.exe File opened (read-only) \??\W: gzczynd.exe File opened (read-only) \??\X: gzczynd.exe File opened (read-only) \??\B: gzczynd.exe File opened (read-only) \??\G: gzczynd.exe File opened (read-only) \??\M: gzczynd.exe File opened (read-only) \??\Q: gzczynd.exe File opened (read-only) \??\R: gzczynd.exe File opened (read-only) \??\U: gzczynd.exe File opened (read-only) \??\H: gzczynd.exe File opened (read-only) \??\J: gzczynd.exe File opened (read-only) \??\L: gzczynd.exe File opened (read-only) \??\O: gzczynd.exe File opened (read-only) \??\Z: gzczynd.exe File opened (read-only) \??\Y: gzczynd.exe File opened (read-only) \??\A: gzczynd.exe File opened (read-only) \??\F: gzczynd.exe File opened (read-only) \??\I: gzczynd.exe File opened (read-only) \??\N: gzczynd.exe File opened (read-only) \??\P: gzczynd.exe File opened (read-only) \??\T: gzczynd.exe -
Processes:
gzczynd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\22D99E07 = "3878975225" gzczynd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a997f627b9d789ee2bb5700a9f58eba81081e1ea376dc159195d91354d8fc61c.exe"C:\Users\Admin\AppData\Local\Temp\a997f627b9d789ee2bb5700a9f58eba81081e1ea376dc159195d91354d8fc61c.exe"1⤵
- Adds Run key to start application
PID:1500
-
C:\Users\Admin\AppData\Local\Temp\gzczynd.exeC:\Users\Admin\AppData\Local\Temp\gzczynd.exe -svc1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies Internet Explorer settings
PID:556
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\gzczynd.exeFilesize
240KB
MD512819fe1e2657c2fde9c027ec2fa6b85
SHA1e2b2150c8214c268abbc4dbe71c776190d490bc9
SHA256a997f627b9d789ee2bb5700a9f58eba81081e1ea376dc159195d91354d8fc61c
SHA5121dbd5239b559719a4ad438a279653ed1fcb0d9887834842c6f6d88d5ef1ab98e6609e7a31b58e42b392a9937c42317161686fb041372b17a349be724c55d533b
-
\??\c:\users\admin\appdata\local\temp\gzczynd.exeFilesize
240KB
MD512819fe1e2657c2fde9c027ec2fa6b85
SHA1e2b2150c8214c268abbc4dbe71c776190d490bc9
SHA256a997f627b9d789ee2bb5700a9f58eba81081e1ea376dc159195d91354d8fc61c
SHA5121dbd5239b559719a4ad438a279653ed1fcb0d9887834842c6f6d88d5ef1ab98e6609e7a31b58e42b392a9937c42317161686fb041372b17a349be724c55d533b
-
memory/556-80-0x0000000000240000-0x000000000025A000-memory.dmpFilesize
104KB
-
memory/1500-54-0x0000000000220000-0x0000000000232000-memory.dmpFilesize
72KB
-
memory/1500-55-0x0000000000240000-0x000000000025A000-memory.dmpFilesize
104KB
-
memory/1500-56-0x0000000075D71000-0x0000000075D73000-memory.dmpFilesize
8KB
-
memory/1500-57-0x0000000000240000-0x000000000025A000-memory.dmpFilesize
104KB
-
memory/1500-67-0x0000000000240000-0x000000000025A000-memory.dmpFilesize
104KB
-
memory/1500-81-0x0000000000240000-0x000000000025A000-memory.dmpFilesize
104KB