Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d23848def89126e1313672c44c02f07.exe
Resource
win7-20240319-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0d23848def89126e1313672c44c02f07.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0d23848def89126e1313672c44c02f07.exe
-
Size
340KB
-
MD5
0d23848def89126e1313672c44c02f07
-
SHA1
d3a7d3b023158b631b24bb1fa1daa18aa7e64c15
-
SHA256
5fdb64a7a0f92d15693dad8166756353745ec9323b76364986a991283efbbdc6
-
SHA512
87c95770af94962ab367068f7b81c907e43450a237494198e60746e88c0c354ffe70899391c60d0a3212c08aea1ac7cf93e26ab1fb89ee0b52d31d04ff615e9e
-
SSDEEP
6144:VFyR9SLkWor+akVC5s/durgm7hv8htqiXkIvaX/m7bfTWaUspmHjYT9oFv6wHH/f:bI9SLkWor+akVC5s/dIdEhtqiXkIvaXr
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nczeiw.exe Set value (int) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0d23848def89126e1313672c44c02f07.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation 0d23848def89126e1313672c44c02f07.exe -
Executes dropped EXE 1 IoCs
pid Process 4944 nczeiw.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /t" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /l" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /g" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /P" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /w" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /B" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /R" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /I" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /h" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /a" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /u" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /e" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /C" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /T" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /O" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /y" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /b" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /N" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /p" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /K" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /f" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /Y" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /M" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /W" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /Z" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /r" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /c" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /X" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /Q" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /H" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /S" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /U" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /k" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /n" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /L" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /m" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /s" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /d" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /V" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /z" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /j" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /x" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /i" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /A" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /o" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /G" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /E" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /J" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /D" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /F" nczeiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nczeiw = "C:\\Users\\Admin\\nczeiw.exe /I" 0d23848def89126e1313672c44c02f07.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2716 0d23848def89126e1313672c44c02f07.exe 2716 0d23848def89126e1313672c44c02f07.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe 4944 nczeiw.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2716 0d23848def89126e1313672c44c02f07.exe 4944 nczeiw.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2716 wrote to memory of 4944 2716 0d23848def89126e1313672c44c02f07.exe 93 PID 2716 wrote to memory of 4944 2716 0d23848def89126e1313672c44c02f07.exe 93 PID 2716 wrote to memory of 4944 2716 0d23848def89126e1313672c44c02f07.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d23848def89126e1313672c44c02f07.exe"C:\Users\Admin\AppData\Local\Temp\0d23848def89126e1313672c44c02f07.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\nczeiw.exe"C:\Users\Admin\nczeiw.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4944
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
340KB
MD5f881459a873d382a5d07739ff467dd14
SHA1404d59a4bc824814279030346cdaac95903e3a36
SHA256575d26362627d7b4ff0cecad079f984c7ac8cab8ed760c581036a31b4f8e64cf
SHA5120fa3619b4effa12cc5fdd77d8b2d5ab59589334927a0986ca97077d05896677533f90c8e66a3ebc0edbb02df473b0d72bcce3d859c8f5d45b53012bc45a7aebe