653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1

General

Target

653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
Size

196KB
MD5

73273afd126cdd8d7da6ce164cb752de
SHA1

c0ea751f6685e79e11c01155d23679bd6764e097
SHA256

653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1
SHA512

0dc694dea1a5ec2c10c25b29c2a2a671d385028c7d789511bce6e2fecb0d0d97d05c2b53fb4b60fef25d34266538b9d605120e95f0148d490115d46f640cb4ab
SSDEEP

1536:PVqk3NNb/g/rOaZk1GDGe0Pdb+d6DiUYot00gw3:04bo/xzDDypy6DiUru0gE

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

nzfuij.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	nzfuij.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe

Executes dropped EXE 1 IoCs

Processes:

nzfuij.exe

pid process

2124 nzfuij.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

nzfuij.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /L"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /B"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /k"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /D"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /u"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /U"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /Y"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /V"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /G"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /K"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /o"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /m"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /J"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /b"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /E"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /r"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /g"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /s"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /q"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /F"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /l"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /X"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /N"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /n"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /P"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /h"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /W"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /M"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /Z"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /x"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /A"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /a"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /R"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /f"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /j"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /I"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /Q"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /z"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /T"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /v"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /c"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /H"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /C"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /S"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /p"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /d"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /t"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /y"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /i"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /O"	nzfuij.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nzfuij = "C:\\Users\\Admin\\nzfuij.exe /e"	nzfuij.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

nzfuij.exe

pid	process
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe
2124	nzfuij.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exenzfuij.exe

pid process

4240 653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
2124 nzfuij.exe

pid	process
4240	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
2124	nzfuij.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exenzfuij.exe

description	pid	process	target process
PID 4240 wrote to memory of 2124	4240	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe	nzfuij.exe
PID 4240 wrote to memory of 2124	4240	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe	nzfuij.exe
PID 4240 wrote to memory of 2124	4240	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe	nzfuij.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
PID 2124 wrote to memory of 4240	2124	nzfuij.exe	653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe

C:\Users\Admin\AppData\Local\Temp\653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe
"C:\Users\Admin\AppData\Local\Temp\653b6c3fa68ad72b17d26e9beabe3ec23254ed0462c36cc2a8a14127c5e688a1.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240

C:\Users\Admin\nzfuij.exe
"C:\Users\Admin\nzfuij.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\nzfuij.exe

Filesize
196KB

MD5
358a1c733da38f1613c3f5d1ce311663

SHA1
2254d7d6937f5ad6f0c899639f1aa7b78f1db1a6

SHA256
a321230ace02f7ee0eb106c65d8c5a2a388a14376ccd9bb6343e7ee8824e48cc

SHA512
2d26c3b581a35b0e7fd29a5c26c344ad98e0b54de77f56929bbe145f6dabd3c4e91aafb6c2deaf85410a86005f8f2ca6ffcd51f160450362a6a2f54f83d8eb78

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads