Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 05:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57c2a4488379b3037e5f836ddae0e652.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
57c2a4488379b3037e5f836ddae0e652.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
57c2a4488379b3037e5f836ddae0e652.exe
-
Size
96KB
-
MD5
57c2a4488379b3037e5f836ddae0e652
-
SHA1
227168d1adccbe14f9ca018e93b8e8ca84c1cd85
-
SHA256
3a8253880b77f11eb943ed6ddfbc4b47c3e209d604fd933567111c0e515b1abd
-
SHA512
b6ea431ef142c323c08ca975738dcca6b6dbb62abaf97e4465bfe4deea71aa1eb32fe8ba20374561a3334729a9f3734b98dd150962d7d5594cbb0fe390ccd726
-
SSDEEP
1536:eHEg52GbtyVQO8PXychswjj3RJEEo/k3gzinynEkRldUEPjlijOeWNIjP:ME/GUOychxzRqEkMCRld8WCP
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" bpzaor.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 57c2a4488379b3037e5f836ddae0e652.exe -
Executes dropped EXE 1 IoCs
pid Process 2788 bpzaor.exe -
Loads dropped DLL 2 IoCs
pid Process 1280 57c2a4488379b3037e5f836ddae0e652.exe 1280 57c2a4488379b3037e5f836ddae0e652.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /E" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /F" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /Y" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /z" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /O" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /p" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /o" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /J" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /l" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /t" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /b" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /c" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /U" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /n" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /S" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /A" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /T" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /B" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /g" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /N" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /a" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /D" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /e" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /K" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /q" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /Z" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /s" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /y" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /v" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /M" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /f" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /G" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /Q" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /P" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /u" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /r" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /C" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /L" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /H" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /d" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /X" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /h" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /I" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /w" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /Y" 57c2a4488379b3037e5f836ddae0e652.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /i" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /V" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /R" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /W" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /k" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /x" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /m" bpzaor.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\bpzaor = "C:\\Users\\Admin\\bpzaor.exe /j" bpzaor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1280 57c2a4488379b3037e5f836ddae0e652.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe 2788 bpzaor.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1280 57c2a4488379b3037e5f836ddae0e652.exe 2788 bpzaor.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1280 wrote to memory of 2788 1280 57c2a4488379b3037e5f836ddae0e652.exe 28 PID 1280 wrote to memory of 2788 1280 57c2a4488379b3037e5f836ddae0e652.exe 28 PID 1280 wrote to memory of 2788 1280 57c2a4488379b3037e5f836ddae0e652.exe 28 PID 1280 wrote to memory of 2788 1280 57c2a4488379b3037e5f836ddae0e652.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\57c2a4488379b3037e5f836ddae0e652.exe"C:\Users\Admin\AppData\Local\Temp\57c2a4488379b3037e5f836ddae0e652.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\bpzaor.exe"C:\Users\Admin\bpzaor.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2788
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD546ad961822b72ba624b82f8e3d55981d
SHA1746fd4c2ec55ca205771cd08a4b0c0243b549aa2
SHA256682f8b78c34ac3f6c4050937b6d19e44752e1bf4bb08e8d6e53d55c9490b9ae8
SHA512f62d0f3b98bc9bdfae06a5ee3a704f80910c472c0fc0a124aac4bfb290016767b568476562e082f9b8b3102093426f06f70cd40a178767d05605aaef01a88bec