b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e

General

Target

b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe
Size

216KB
MD5

4682ceb4a51a4663c546e1a7293b6d47
SHA1

5179511e0988435069bc119fc340b6020d5df4b4
SHA256

b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e
SHA512

2fcfdbe9a1995c56ac946f7932b7efd253ae098e17814861b16c29b793cab25b20719c5b67031d2eb26acc215a0a87e025ed0896c599c210c03b0e5387b33bbd
SSDEEP

6144:vTmaZZP5XA+eMIRQwSQ4YH34AAoo070vYN0DQPwkqfS2Qh20K/BG0t7/lG1G8FGk:k/wVY

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	mezop.exe

Executes dropped EXE 1 IoCs

pid	Process
4004	mezop.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe

Adds Run key to start application 2 TTPs 17 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /v"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /b"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /j"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /g"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /r"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /r"	b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /n"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /l"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /t"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /c"	mezop.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /i"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /o"	mezop.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /k"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /e"	mezop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mezop = "C:\\Users\\Admin\\mezop.exe /p"	mezop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2292	b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe
2292	b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe
4004	mezop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2292	b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe
4004	mezop.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 4004	2292	b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe	87
PID 2292 wrote to memory of 4004	2292	b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe	87
PID 2292 wrote to memory of 4004	2292	b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe	87

C:\Users\Admin\AppData\Local\Temp\b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe
"C:\Users\Admin\AppData\Local\Temp\b24549946b2b8f0e39bfd0e904791af731f7ca4a8973eed3bbfb6859856dc02e.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\mezop.exe
  "C:\Users\Admin\mezop.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\mezop.exe

Filesize
216KB

MD5
2c1659926d39ce1d5580657930e1af73

SHA1
62f3f456c86f16178861d63738027ea391161de7

SHA256
5ae8f5e267529e6c7db6df5192c09f6f704d07fb07c71141d3eec897dae920c0

SHA512
2ab67c6e19e5016f849f19aa5038d75b5f7ba3434f5efba964e05b7c538432e5fad65a3c6020c658c1fcb003a6b1376cdcda2ae13a4e188656ca8c2d03bb2e9a

Download Submit
C:\Users\Admin\mezop.exe

Filesize
216KB

MD5
2c1659926d39ce1d5580657930e1af73

SHA1
62f3f456c86f16178861d63738027ea391161de7

SHA256
5ae8f5e267529e6c7db6df5192c09f6f704d07fb07c71141d3eec897dae920c0

SHA512
2ab67c6e19e5016f849f19aa5038d75b5f7ba3434f5efba964e05b7c538432e5fad65a3c6020c658c1fcb003a6b1376cdcda2ae13a4e188656ca8c2d03bb2e9a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads