9c93cd60a6108167da782ab136db0779f684b4a6cfbf6e9ac570a66c31431ac2

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HZDApp.exe
Size

165KB
MD5

1c3d5bd8851c993fc570da59bf5f67de
SHA1

2d8510dc21bf2715fef609844998d3937140f47f
SHA256

2f02ca86d235fcb07877ec46c95ab5a935ec44d7e8c1c9148f3305bef0919412
SHA512

45123039a1c7b282f041164d96278edaa3e0f4357e23fba7be0d7d65799e91b9dec8e6f2085e2876513496118d17b618555032982cc66c23f1e4d1b5d0bdf13c
SSDEEP

3072:E7g1RJZxKaXAklOVxALdh3P06p9YPfFYfXGn779dPNWGi1:E7YRjJlOwRh3P/XYP9YfXqX7Pa

Score

1^/10

Malware Config

Signatures

Modifies registry class 36 IoCs

Processes:

HZDApp.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{020F31A0-4478-41D0-90BF-4BBC7CE63889}	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{020F31A0-4478-41D0-90BF-4BBC7CE63889}\1.0	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\TypeLib	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HZDApp.Application\ = "HZDApp.Application"	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C5E32E1-1E09-4396-B833-A6F5051A1FF1}\LocalServer32	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{020F31A0-4478-41D0-90BF-4BBC7CE63889}\1.0\HELPDIR	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\TypeLib\ = "{020F31A0-4478-41D0-90BF-4BBC7CE63889}"	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\ProxyStubClsid32	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C5E32E1-1E09-4396-B833-A6F5051A1FF1}\InprocHandler32\ = "ole32.dll"	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{020F31A0-4478-41D0-90BF-4BBC7CE63889}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HZDApp.exe"	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\ = "IHZDApp"	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{020F31A0-4478-41D0-90BF-4BBC7CE63889}\1.0\0	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{020F31A0-4478-41D0-90BF-4BBC7CE63889}\1.0\FLAGS	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{020F31A0-4478-41D0-90BF-4BBC7CE63889}\1.0\HELPDIR\	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\TypeLib\Version = "1.0"	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HZDApp.Application\CLSID\ = "{5C5E32E1-1E09-4396-B833-A6F5051A1FF1}"	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C5E32E1-1E09-4396-B833-A6F5051A1FF1}\ProgID\ = "HZDApp.Application"	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C5E32E1-1E09-4396-B833-A6F5051A1FF1}\InprocHandler32	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\ProxyStubClsid32	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C5E32E1-1E09-4396-B833-A6F5051A1FF1}\ = "HZDApp.Application"	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C5E32E1-1E09-4396-B833-A6F5051A1FF1}\ProgID	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{020F31A0-4478-41D0-90BF-4BBC7CE63889}\1.0\ = "HZDApp"	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{020F31A0-4478-41D0-90BF-4BBC7CE63889}\1.0\FLAGS\ = "0"	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\TypeLib\ = "{020F31A0-4478-41D0-90BF-4BBC7CE63889}"	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HZDApp.Application\CLSID	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C5E32E1-1E09-4396-B833-A6F5051A1FF1}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\HZDApp.exe"	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{020F31A0-4478-41D0-90BF-4BBC7CE63889}\1.0\0\win32	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\TypeLib	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\TypeLib\Version = "1.0"	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\ = "IHZDApp"	HZDApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5BBD8C31-B90C-4C40-981C-23AC1B7A2335}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HZDApp.Application	HZDApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5C5E32E1-1E09-4396-B833-A6F5051A1FF1}	HZDApp.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

HZDApp.exe

pid process

1848 HZDApp.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

HZDApp.exe

pid process

1848 HZDApp.exe
1848 HZDApp.exe

pid	process
1848	HZDApp.exe

pid	process
1848	HZDApp.exe
1848	HZDApp.exe

C:\Users\Admin\AppData\Local\Temp\HZDApp.exe
"C:\Users\Admin\AppData\Local\Temp\HZDApp.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1848

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads