Analysis
-
max time kernel
270s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 16:57
Static task
static1
Behavioral task
behavioral1
Sample
d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe
-
Size
232KB
-
MD5
234f5a691252b35e759faf9ed4367c40
-
SHA1
8fd6ba0cb710c4fed6cef49933e13e75ff8cb0ee
-
SHA256
d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223
-
SHA512
2a3244b4e42175ead6bff2823814a88858ba99c224cdd8e1cafce6e95e9586b997beab6af51a70a6b42f5be8055f469e116c2f54a60611428f0478c34b1d886b
-
SSDEEP
1536:hbz5l+GomoDo0omoEo4A5AVzotokoXoOoioVo2oEogoFoPoeoWooo7oxozoZoMod:57+JA5AVap/+
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ntzow.exe -
Executes dropped EXE 1 IoCs
pid Process 1104 ntzow.exe -
Loads dropped DLL 2 IoCs
pid Process 544 d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe 544 d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe -
Adds Run key to start application 2 TTPs 44 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /V" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /n" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /r" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /m" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /C" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /A" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /U" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /b" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /G" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /F" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /M" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /v" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /P" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /W" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /k" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /Z" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /E" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /H" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /S" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /c" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /g" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /u" ntzow.exe Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /o" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /O" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /e" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /z" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /I" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /i" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /y" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /p" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /a" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /T" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /t" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /f" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /L" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /N" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /Y" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /q" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /w" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /J" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /D" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /s" ntzow.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntzow = "C:\\Users\\Admin\\ntzow.exe /Q" ntzow.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe 1104 ntzow.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 544 d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe 1104 ntzow.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 544 wrote to memory of 1104 544 d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe 28 PID 544 wrote to memory of 1104 544 d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe 28 PID 544 wrote to memory of 1104 544 d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe 28 PID 544 wrote to memory of 1104 544 d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe 28 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19 PID 1104 wrote to memory of 544 1104 ntzow.exe 19
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe"C:\Users\Admin\AppData\Local\Temp\d8a7ba5ec3588e592286a8a49956dd15ad8eab6ea99c69fbb02ed8de52e3c223.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\ntzow.exe"C:\Users\Admin\ntzow.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD579bc11e8edcd69cf07baeffac7945b6a
SHA1cd6ab8a86010f31bd1a06b136f3b02d3835106d9
SHA256e1caae90fdff46854ab55d2d6a1f25fbbeb4ae4255cc3ff3194e114a2d830e7a
SHA512e79c43dadee19ee0ca2a90efabae5b8ed529280ecf3c4dd697db16c003a2815a85292bd9a3138a34395afbbf09aaddafd1b61cd8a7caa3d146c932c3fc4124e5
-
Filesize
232KB
MD579bc11e8edcd69cf07baeffac7945b6a
SHA1cd6ab8a86010f31bd1a06b136f3b02d3835106d9
SHA256e1caae90fdff46854ab55d2d6a1f25fbbeb4ae4255cc3ff3194e114a2d830e7a
SHA512e79c43dadee19ee0ca2a90efabae5b8ed529280ecf3c4dd697db16c003a2815a85292bd9a3138a34395afbbf09aaddafd1b61cd8a7caa3d146c932c3fc4124e5
-
Filesize
232KB
MD579bc11e8edcd69cf07baeffac7945b6a
SHA1cd6ab8a86010f31bd1a06b136f3b02d3835106d9
SHA256e1caae90fdff46854ab55d2d6a1f25fbbeb4ae4255cc3ff3194e114a2d830e7a
SHA512e79c43dadee19ee0ca2a90efabae5b8ed529280ecf3c4dd697db16c003a2815a85292bd9a3138a34395afbbf09aaddafd1b61cd8a7caa3d146c932c3fc4124e5
-
Filesize
232KB
MD579bc11e8edcd69cf07baeffac7945b6a
SHA1cd6ab8a86010f31bd1a06b136f3b02d3835106d9
SHA256e1caae90fdff46854ab55d2d6a1f25fbbeb4ae4255cc3ff3194e114a2d830e7a
SHA512e79c43dadee19ee0ca2a90efabae5b8ed529280ecf3c4dd697db16c003a2815a85292bd9a3138a34395afbbf09aaddafd1b61cd8a7caa3d146c932c3fc4124e5