d99543c0bbf2eea9b684acc9d662368ad460af7f55af7a489cc77089ae37a6e3

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb766ea31407d80cd68e39c9ebb33035.exe
Size

15KB
MD5

cb766ea31407d80cd68e39c9ebb33035
SHA1

2b0b6d8f58f12fa2049a8746e8dabf1b4d965b45
SHA256

d99543c0bbf2eea9b684acc9d662368ad460af7f55af7a489cc77089ae37a6e3
SHA512

a956915375ee2d0411b80b47e0e37bd52a7ae1338afd07038d02b4f2dd8e93a38cce34e85b412167e70999788d49bc60dc33e74e9ddba95b93af77d254b07143
SSDEEP

384:/qPKe+4fpf8RY3/6EbRW/z213u5qwClUhXllYM5yxos6W:/TY73yEWQ3BlUdlRybp

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\nzlzfamw.dll = "{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}"	cb766ea31407d80cd68e39c9ebb33035.exe

Deletes itself 1 IoCs

pid	Process
2592	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
2736	cb766ea31407d80cd68e39c9ebb33035.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\nzlzfamw.tmp	cb766ea31407d80cd68e39c9ebb33035.exe
File opened for modification	C:\Windows\SysWOW64\nzlzfamw.tmp	cb766ea31407d80cd68e39c9ebb33035.exe
File opened for modification	C:\Windows\SysWOW64\nzlzfamw.nls	cb766ea31407d80cd68e39c9ebb33035.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}	cb766ea31407d80cd68e39c9ebb33035.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32	cb766ea31407d80cd68e39c9ebb33035.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ = "C:\\Windows\\SysWow64\\nzlzfamw.dll"	cb766ea31407d80cd68e39c9ebb33035.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ThreadingModel = "Apartment"	cb766ea31407d80cd68e39c9ebb33035.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2736	cb766ea31407d80cd68e39c9ebb33035.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2736	cb766ea31407d80cd68e39c9ebb33035.exe
2736	cb766ea31407d80cd68e39c9ebb33035.exe
2736	cb766ea31407d80cd68e39c9ebb33035.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2592	2736	cb766ea31407d80cd68e39c9ebb33035.exe	30
PID 2736 wrote to memory of 2592	2736	cb766ea31407d80cd68e39c9ebb33035.exe	30
PID 2736 wrote to memory of 2592	2736	cb766ea31407d80cd68e39c9ebb33035.exe	30
PID 2736 wrote to memory of 2592	2736	cb766ea31407d80cd68e39c9ebb33035.exe	30

C:\Users\Admin\AppData\Local\Temp\cb766ea31407d80cd68e39c9ebb33035.exe
"C:\Users\Admin\AppData\Local\Temp\cb766ea31407d80cd68e39c9ebb33035.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\1075.tmp.bat
  2⤵
  - Deletes itself
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1075.tmp.bat

Filesize
179B

MD5
958f26df8e4c8bf7444a5f6f1c9ecfb2

SHA1
50f7ea15ed22ec8e1ec64ca477cd8c150d831cae

SHA256
f6f8d802d55c59c6b53e4de6e75280f53e5b51a7f236d9b18795ad2ac20d8250

SHA512
63b2ccbfd3791a86a85bedaa61030fa1a47159ed5f43637eaac716d5e4ee1b05080669141570b0bd136507202a77ecffab246ffa1c71c8b4bfea3af2c71eaff3

Download Submit
C:\Windows\SysWOW64\nzlzfamw.dll

Filesize
2.3MB

MD5
071d49cb9c5cd89bf9a27fa1ba66bf2e

SHA1
a593117192b990e4e1010e41931fc796044c3be6

SHA256
aca26c21103d7ab1cffae1d4a26bde7a5f61f9751a9e5c7a16f3cdd596cf7b16

SHA512
f021a168d14ff88113f19541897d3694985fe85f52c5d5c68a6bad509847b56e24329176a3cb1aef8d1bf98f224f41a356683ac2d177d4a35f9a85b7256cffc8

Download Submit
memory/2736-8-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download
memory/2736-18-0x0000000010000000-0x000000001006C000-memory.dmp

Filesize
432KB

Download