Overview
overview
6Static
static
3MKZ_Injektor.exe
windows7-x64
6MKZ_Injektor.exe
windows10-2004-x64
6Minimize_MKZSCC.dll
windows7-x64
3Minimize_MKZSCC.dll
windows10-2004-x64
3WallShot_MKZSCC.dll
windows7-x64
3WallShot_MKZSCC.dll
windows10-2004-x64
3glxpbuttonz.dll
windows7-x64
3glxpbuttonz.dll
windows10-2004-x64
3Analysis
-
max time kernel
53s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13-10-2024 10:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MKZ_Injektor.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
MKZ_Injektor.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Minimize_MKZSCC.dll
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Minimize_MKZSCC.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
WallShot_MKZSCC.dll
Resource
win7-20241010-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
WallShot_MKZSCC.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
glxpbuttonz.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
glxpbuttonz.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
MKZ_Injektor.exe
-
Size
220KB
-
MD5
c9286240206dc9c20fa4c0a2cc22ffe0
-
SHA1
a0721b382b62e56c0364b3653b3d38140138c1c1
-
SHA256
9fe33c923d36bf3e06bde190e7f327217782955d7106e14910048947b08b86a5
-
SHA512
348d0feb59ec1957487c2850accacadf2b7daf20c78dc060ae37c2bf1cdf995d0e4978d164c90bf0f116fd791763dab7f9268ef6e91b3cb476092b9ce9abd54b
-
SSDEEP
3072:EtBqMBirTYgMJ0sRWznBOHSYzOZvMTLYNKtUh9Dw3zedEt00edkvgOO:kqMc3MJzIzw9zMMLCQUTMYEt09d3O
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: MKZ_Injektor.exe File opened (read-only) \??\K: MKZ_Injektor.exe File opened (read-only) \??\S: MKZ_Injektor.exe File opened (read-only) \??\X: MKZ_Injektor.exe File opened (read-only) \??\J: MKZ_Injektor.exe File opened (read-only) \??\O: MKZ_Injektor.exe File opened (read-only) \??\T: MKZ_Injektor.exe File opened (read-only) \??\W: MKZ_Injektor.exe File opened (read-only) \??\M: MKZ_Injektor.exe File opened (read-only) \??\P: MKZ_Injektor.exe File opened (read-only) \??\R: MKZ_Injektor.exe File opened (read-only) \??\A: MKZ_Injektor.exe File opened (read-only) \??\E: MKZ_Injektor.exe File opened (read-only) \??\H: MKZ_Injektor.exe File opened (read-only) \??\I: MKZ_Injektor.exe File opened (read-only) \??\L: MKZ_Injektor.exe File opened (read-only) \??\V: MKZ_Injektor.exe File opened (read-only) \??\Z: MKZ_Injektor.exe File opened (read-only) \??\B: MKZ_Injektor.exe File opened (read-only) \??\N: MKZ_Injektor.exe File opened (read-only) \??\Q: MKZ_Injektor.exe File opened (read-only) \??\U: MKZ_Injektor.exe File opened (read-only) \??\Y: MKZ_Injektor.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MKZ_Injektor.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3583FCE-0595-4681-9ACD-48F7805DEFE1}\1.0 MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\ToolboxBitmap32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\glxpbuttonz.ocx, 30000" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\MiscStatus\1 MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\glxpbuttonz.UserButtonz\Clsid MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\TypeLib\ = "{E3583FCE-0595-4681-9ACD-48F7805DEFE1}" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\ = "_UserButtonz" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\Implemented Categories MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\TypeLib MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3583FCE-0595-4681-9ACD-48F7805DEFE1}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\glxpbuttonz.ocx" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\TypeLib\Version = "1.0" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\TypeLib MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502} MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\ProxyStubClsid32 MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\ProgID MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\Control MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\ = "UserButtonz" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\ProxyStubClsid32 MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\ToolboxBitmap32 MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\MiscStatus\ = "0" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\ProxyStubClsid MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3583FCE-0595-4681-9ACD-48F7805DEFE1}\1.0\HELPDIR MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\TypeLib\ = "{E3583FCE-0595-4681-9ACD-48F7805DEFE1}" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\TypeLib\Version = "1.0" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A} MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\Control\ MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\glxpbuttonz.UserButtonz\ = "glxpbuttonz.UserButtonz" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352} MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3583FCE-0595-4681-9ACD-48F7805DEFE1}\1.0\FLAGS\ = "2" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3583FCE-0595-4681-9ACD-48F7805DEFE1}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\TypeLib MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\VERSION MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\glxpbuttonz.UserButtonz\Clsid\ = "{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\ = "UserButtonz" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\VERSION\ = "1.0" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3583FCE-0595-4681-9ACD-48F7805DEFE1} MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3583FCE-0595-4681-9ACD-48F7805DEFE1}\1.0\0 MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89} MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\TypeLib MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\TypeLib\Version = "1.0" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\TypeLib\ = "{E3583FCE-0595-4681-9ACD-48F7805DEFE1}" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\ProxyStubClsid32 MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\TypeLib\ = "{E3583FCE-0595-4681-9ACD-48F7805DEFE1}" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3583FCE-0595-4681-9ACD-48F7805DEFE1}\1.0\0\win32 MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D} MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\ProxyStubClsid32 MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\ = "__UserButtonz" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\TypeLib MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\InprocServer32 MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\ProxyStubClsid MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352} MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\MiscStatus MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89} MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\ = "_UserButtonz" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0EBC7EC4-ED41-49C7-86B7-9F63E8B28C89}\TypeLib\Version = "1.0" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D}\TypeLib\ = "{E3583FCE-0595-4681-9ACD-48F7805DEFE1}" MKZ_Injektor.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4B78F3AA-5862-42FC-83A0-A6969DC0B60D} MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8ED08C53-BB00-4B9A-8037-D38D22FF4B7A}\ProgID\ = "glxpbuttonz.UserButtonz" MKZ_Injektor.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3583FCE-0595-4681-9ACD-48F7805DEFE1}\1.0\ = "glxpbuttonz" MKZ_Injektor.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2376 MKZ_Injektor.exe 2376 MKZ_Injektor.exe