Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
21/02/2024, 14:44
General
-
Target
DZKJ-1.0.0.52.exe
-
Size
14.8MB
-
MD5
7d94503119588f1e769d1a871a949969
-
SHA1
d31a2fcb9fa635b7ca9cda8b6a239815a6645dcd
-
SHA256
dcb378e8645acb7a8c2be0f51f9c9c125044659a73390d524accb96772f79a16
-
SHA512
cc1b52450d9623d6766320cc80346fe6e8e00f669b2a3f7fd8ab95e5c610803d66457e886e62dff371421982dd21c259159eb5a0907c94562f018e816e3dd95f
-
SSDEEP
196608:WgA3UoPtKLBSIkMmf5XPmImn/2gpi08QukGZl9lEL38NlxgjewYk1jrMX+5j6txW:pAkolIBShMwu+2ukmoKlxgjewXmxB35m
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Themida packer 16 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 17 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DZKJ-1.0.0.52.exe"C:\Users\Admin\AppData\Local\Temp\DZKJ-1.0.0.52.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 C:\Users\Admin\AppData\Local\Temp\DZPdf.dll /s2⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 24402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4028 -ip 40281⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\DZKJ\DZClient.exe"C:\Users\Admin\AppData\Roaming\DZKJ\DZClient.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 C:\Users\Admin\AppData\Local\Temp\DZPdf.dll /s2⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 21962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4948 -ip 49481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5fa8020de7de927a48fa67e61aa2d5f5d
SHA1fe7ed0d77da0d6a0bcd8248ff2cc1e15cf28000a
SHA256afdeee006b0f70830975d26551ad0d0a20cb31da8a84ea5ebb241296e60a4322
SHA51280f07a56ada9fec6c568306d8cabbdc07ce79a90d0a5d8a6003eaa48230ff9acc321d0a3473cd7051620662f6026492bf44347f434383b68b1f787ffc17238ed
-
Filesize
23KB
MD5ccc1e4426a3a6581d10e7b596ae36981
SHA1b9ff9ed2f828f60cf363d08dd8fa6a0a57851993
SHA2565717e37d9b0f6166bd447998d15742d46bd7e0a9676e893d7e42cf958decb78f
SHA5129e3164df9aad7dfce5bc511c0277f6480ec395af5cbc5d0ef36ac866602a3934fdf61a2072504ca63a1810ffc62f89b0957c328072d02f4365781cb10d13657c
-
Filesize
9.9MB
MD535d66db087de03b967ad8d62fa22dbb9
SHA1e9cd8518fa44253bb1e3582ef0323228932e3bb6
SHA256a42a1b5caf838b3d211c5e4c3aef41aa4b60d0a9394264810a0768f60c330e2c
SHA5123a793be20fe5f6fe8763af18bce1120c4bad63c8e6110120d92e18852d86490d58ee03dd11acc3f2f8eb15911fbbcb93edc6c7d244a4f0dafb45782591f64484
-
Filesize
4.1MB
MD50c84839c5e22ed47d3bb88fed6a90563
SHA15dd9025f3088eea1948077215273572af5de8c74
SHA2563cdaef6926e2071c679c2ca498bfdd98c0c35093fbe93116871dffcb278aa97b
SHA5121d860467185cf8f0ddcabbe5b032f89b30cd98964664b580480eb6905e014d2b6f4f4dd9b5a8fba933b120080f12999e6a517b5a7f2f0039bec48407bacc1c8b
-
Filesize
2.6MB
MD5335111b7d8439004752c83fcc0689c28
SHA1403626c1b67752cfdf5565d2cfcb9362f3ad3fd3
SHA256b958031172ef4424abe0f2dbc5282d6d1061e4dcfe7f28d400b31215d7273caa
SHA512ff250f981f5d2bc5ec22adeec9f35f5db22a6a2eeed4620827563e02a874e07ff7ac64c111c1fa5169aca4174ca59170af9def960a5ad0482c7bf4579356e456
-
Filesize
14.6MB
MD5bf09a8c4d0980c7c53c0a783364db3b6
SHA137f7a0601dbb1270aac1a8c2d241e9cf90b57b80
SHA2565a50581ef9dccb6e34ae6cc8d244905e81ae659348a6a16d4dfe89d0b52cc4be
SHA51271a11f322480d0572c5ca95045d69b552f03ee8b40acf87e77be1f24a33b554ca3205bac7b013eb2c40b7b1954e8c213a0424f88066e9476467a5598611636a8
-
Filesize
14.8MB
MD57d94503119588f1e769d1a871a949969
SHA1d31a2fcb9fa635b7ca9cda8b6a239815a6645dcd
SHA256dcb378e8645acb7a8c2be0f51f9c9c125044659a73390d524accb96772f79a16
SHA512cc1b52450d9623d6766320cc80346fe6e8e00f669b2a3f7fd8ab95e5c610803d66457e886e62dff371421982dd21c259159eb5a0907c94562f018e816e3dd95f
-
Filesize
40B
MD573e71555d444cbe8ac5e359a73b77c84
SHA171ea9cc86fd760fc5589557a5e8cf3eca085db09
SHA25622a67f42c9e5546f9d6be103886942bb81dd02bc541e87c52e5ace6aa28ada11
SHA5126b0bc7f72b2b8a04f95f186f0dd6a876d57135fa8a88a722627d7d7d420045c40c1638ae2b9c314cc255c70e7d5940a3182e023961a769d1f24ea0d71222530c
-
Filesize
4KB
-
Filesize
21.0MB
-
Filesize
4KB
-
Filesize
21.0MB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
21.0MB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
172KB
-
Filesize
8KB
-
Filesize
21.0MB
-
Filesize
21.0MB
-
Filesize
21.0MB
-
Filesize
21.0MB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
21.0MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
21.0MB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
21.0MB
-
Filesize
4KB
-
Filesize
21.0MB
-
Filesize
21.0MB
-
Filesize
21.0MB
-
Filesize
21.0MB
-
Filesize
960KB
-
Filesize
172KB
