Analysis
- max time kernel
133s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2024, 16:54
Static task
static1
Behavioral task
behavioral1
Sample
4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
18 signatures
150 seconds
General
- Target 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe
- Size 7.1MB
- Sample241111-vem26asapp
- SHA256 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd
- MD5 f51696d3debb1a770199360b52416e78
- SHA1 ff3ec84759fe3071b61ac7b2824ee827b8465f06
- SHA512 4398232b39c094f0dc17eb88dde704ab1c0c8ed32c8c8190846c07b45be679c7a5f1c15cfde322d9c470f0282df6ea4875d40361b40c6f527c584e7122b83e58
- SSDEEP 98304:vNK/3005rMit6ZVYcEjOsEIQ2O9RhyUmi7bhjdBTfDiL2264dnQRlSEJUnR+/dji:VK8BWJjtlQ2vEhjyL16jRw6Q
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\KuaiZipDrive.sys KZMount2.exe File opened for modification C:\Windows\system32\drivers\KuaiZipDrive.sys KZMount2.exe - Server Software Component: Terminal Services DLL 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KuaizipUpdateChecker\Parameters\ServiceDll = "C:\\Program Files\\¿ìѹ\\X86\\kuaizipUpdateChecker.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KuaizipUpdateChecker\Parameters\ServiceDll = "C:\\Program Files\\¿ìѹ\\X86\\kuaizipUpdateChecker.dll" regsvr32.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 4 IoCs
pid Process 2788 KZMount2.exe 3104 KZMount2.exe 4960 KuaiZip.exe 404 KZReport.exe - Loads dropped DLL 12 IoCs
pid Process 1620 regsvr32.exe 2424 svchost.exe 2788 KZMount2.exe 2788 KZMount2.exe 2788 KZMount2.exe 3104 KZMount2.exe 3104 KZMount2.exe 1592 regsvr32.exe 4960 KuaiZip.exe 4260 regsvr32.exe 4960 KuaiZip.exe 4628 regsvr32.exe - Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ContextMenuExt\ = "{6ADF19E3-77A3-4395-ADB4-9FD7D351EB3E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ContextMenuExt regsvr32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File opened for modification \??\PhysicalDrive0 KZReport.exe - Drops file in Program Files directory 39 IoCs
description ioc Process File created C:\Program Files\¿ìѹ\X86\finderlib.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X64\Mount.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\7zNew.dat 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\data\slimdata.dat 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\__-________.URL 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\DiskOpt.exe 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\DuiLib.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\KzNew.dat 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\ZipNew.dat 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X64\KZipShell.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\KZModule.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\skin\disopt.skn 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X64\KZMount2.exe 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\Update.exe 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\UpdateChecker.exe 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\7z.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X64\KuaiZipDrive.sys 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\SLDefault.xml 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\KuaiZip.exe 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\Uninst.exe 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X64\KZFormat.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X64\KZModule.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\MountCore.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X64\SetupHelper.exe 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\SetupHelper.exe 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\lang\Chs_Lang.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\ali\kzshop.ico 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\ErrorMsg.xml 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\readme.txt 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\KZReport.exe 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\KZTui.exe 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\KZFormat.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\ali\jp.png 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\Mount.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X86\sfx\kzSetup_chs.sfx 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X64\7z.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X64\lang\Chs_Lang.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe File created C:\Program Files\¿ìѹ\X64\MountCore.dll 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KuaiZip.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language KZReport.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip_FileAsso.Origin\.003\ = "NoAssociate.KZ" KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.096 KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AAA0C5B8-933F-4200-93AD-B143D7FFF9F2}\InprocServer32\ = "C:\\Program Files\\¿ìѹ\\X64\\KZipShell.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip_FileAsso.Origin\.019 KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wim\ = "KuaiZip.wim" KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.083 KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZipMount.ape\DefaultIcon KZMount2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "KuaiZip.tbz" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\QZipShell.DLL\AppID = "{9CC34070-3A38-4C7A-89CB-EF8177EF07A1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.013\shell KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.064\DefaultIcon KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.jar\ = "快压 JAR 压缩文件 " KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.068\DefaultIcon KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.029 KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip_FileAsso.Origin\.035\ = "NoAssociate.KZ" KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZipMount.mds\shell\open KZMount2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.cab\shell\open\command\ = "C:\\Program Files\\¿ìѹ\\X86\\KuaiZip.exe \"%1\"" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.010\ = "KuaiZip.010" KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.02\shell KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip_FileAsso.Origin\.027\ = "NoAssociate.KZ" KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZipMount.isz KZMount2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZipMount.bin\shell\open\command\ = "C:\\Program Files\\¿ìѹ\\X64\\KZMount2.exe -NewDriver \"%1\"" KZMount2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip_FileAsso.Origin\.arj\ KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.034\DefaultIcon\ = "C:\\Program Files\\¿ìѹ\\X86\\KuaiZip.exe,0" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.019\shell\open\command\ = "C:\\Program Files\\¿ìѹ\\X86\\KuaiZip.exe \"%1\"" KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.068\shell\open KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.071\shell\open\command KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.DragDropMenu\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.PropertyExt\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\HardLinkShlExt regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.096\shell\open KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZipMount.vcd\DefaultIcon\ = "C:\\Program Files\\¿ìѹ\\X64\\KZMount2.exe,0" KZMount2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.05\shell\open\command KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.066\ = "快压 066 压缩文件 " KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.052 KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.ContextMenuExt\ = "ContextMenuExt Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AAA0C5B8-933F-4200-93AD-B143D7FFF9F2}\TypeLib\ = "{86C4C3BA-4EA4-4CF8-98B9-6B07B477B835}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.014\DefaultIcon\ = "C:\\Program Files\\¿ìѹ\\X86\\KuaiZip.exe,0" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.062\ = "快压 062 压缩文件 " KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.085\shell KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZipMount_FileAsso.Origin\.mdf\ = "NoAssociate.KuaiZipMount" KZMount2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.013\ = "KuaiZip.013" KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.096 KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gzip\ = "KuaiZip.gzip" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip_FileAsso.Origin\.006\ = "NoAssociate.KZ" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip_FileAsso.Origin\.060\ = "NoAssociate.KZ" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.084\ = "快压 084 压缩文件 " KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.024\ = "KuaiZip.024" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bin\ = "KuaiZipMount.bin" KZMount2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.ContextMenuExt.1\ = "ContextMenuExt Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\ContextMenuExt\ = "{6ADF19E3-77A3-4395-ADB4-9FD7D351EB3E}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.DragDropMenu.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nrg KZMount2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.rpm\ = "快压 RPM 压缩文件 " KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.053 KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QZipShell.DragDropMenu.1\CLSID\ = "{3DCCD550-7586-40D2-A51D-D2F98EC06B3C}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.09\shell\open KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.021\shell\open\command KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip_FileAsso.Origin\.093\ = "NoAssociate.KZ" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip_FileAsso.Origin\.068\ = "NoAssociate.KZ" KuaiZip.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.lzh\shell\open\command KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.042\shell\open\command\ = "C:\\Program Files\\¿ìѹ\\X86\\KuaiZip.exe \"%1\"" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.075\shell\open\command\ = "C:\\Program Files\\¿ìѹ\\X86\\KuaiZip.exe \"%1\"" KuaiZip.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KuaiZip.057\shell\open\command\ = "C:\\Program Files\\¿ìѹ\\X86\\KuaiZip.exe \"%1\"" KuaiZip.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1640 schtasks.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 404 KZReport.exe - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4848 wrote to memory of 1424 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 83 PID 4848 wrote to memory of 1424 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 83 PID 4848 wrote to memory of 1424 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 83 PID 4848 wrote to memory of 1620 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 87 PID 4848 wrote to memory of 1620 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 87 PID 4848 wrote to memory of 1620 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 87 PID 4848 wrote to memory of 2788 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 90 PID 4848 wrote to memory of 2788 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 90 PID 4848 wrote to memory of 3104 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 91 PID 4848 wrote to memory of 3104 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 91 PID 4848 wrote to memory of 1592 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 93 PID 4848 wrote to memory of 1592 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 93 PID 4848 wrote to memory of 1592 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 93 PID 4848 wrote to memory of 4960 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 94 PID 4848 wrote to memory of 4960 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 94 PID 4848 wrote to memory of 4960 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 94 PID 4848 wrote to memory of 4260 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 96 PID 4848 wrote to memory of 4260 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 96 PID 4848 wrote to memory of 4260 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 96 PID 4260 wrote to memory of 4628 4260 regsvr32.exe 97 PID 4260 wrote to memory of 4628 4260 regsvr32.exe 97 PID 4848 wrote to memory of 1052 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 98 PID 4848 wrote to memory of 1052 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 98 PID 4848 wrote to memory of 1052 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 98 PID 4848 wrote to memory of 1640 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 100 PID 4848 wrote to memory of 1640 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 100 PID 4848 wrote to memory of 1640 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 100 PID 4848 wrote to memory of 404 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 104 PID 4848 wrote to memory of 404 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 104 PID 4848 wrote to memory of 404 4848 4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe"C:\Users\Admin\AppData\Local\Temp\4e9aae4c2f3197b2f96b7e180120c74c1e599520f8b72ef1e256c8e08b7df1bd.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /u /s "C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll"2⤵
- System Location Discovery: System Language Discovery
PID:1424
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll"2⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1620
-
-
C:\Program Files\¿ìѹ\X64\KZMount2.exe"C:\Program Files\¿ìѹ\X64\KZMount2.exe" -InstallDriver2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
PID:2788
-
-
C:\Program Files\¿ìѹ\X64\KZMount2.exe"C:\Program Files\¿ìѹ\X64\KZMount2.exe" -AssocAll2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3104
-
-
C:\Windows\SysWOW64\regsvr32.exeC:\Windows\system32\regsvr32.exe /s "C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll"2⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1592
-
-
C:\Program Files\¿ìѹ\X86\KuaiZip.exe"C:\Program Files\¿ìѹ\X86\KuaiZip.exe" -AssociateAll2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4960
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" "C:\Program Files\¿ìѹ\X64\KZipShell.dll" -s2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\system32\regsvr32.exe"C:\Program Files\¿ìѹ\X64\KZipShell.dll" -s3⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
PID:4628
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /tn KuaiZip_Update /f2⤵
- System Location Discovery: System Language Discovery
PID:1052
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn KuaiZip_Update /tr "C:\PROGRA~1\F85A~1\X86\Update.exe" /sc hourly2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1640
-
-
C:\Program Files\¿ìѹ\X86\KZReport.exe"C:\Program Files\¿ìѹ\X86\KZReport.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:404
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k kuaizipupdatesvc1⤵PID:4360
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k kuaizipupdatesvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2424
Network
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\¿ìѹ\X64\KZMount2.exe
- Size 467KB
- SHA256 0a4005988099b5958842aa8b064f8ea63a62d6b3ce8cf474df810b229768d2aa
- MD5 6092e931993ce98e90bd9a8ba5e0f81d
- SHA1 9f6e2cfee88a965ac9c621244ae4e743179926bb
- SHA512 a317e1afc8c9144481ef2322019a798c32d3aaa54521c3084816cc2fbe6283b7b1f9c2d53ddd66247499e0ad9efbc6d424f4561a45c5462e656356ae040d2876
- SSDEEP 6144:OEsA0a5MeCSgvqSxUigBkV8KKesWxTGzWMhcFKMC0JLURqDR:OEsAHC5vqS6EBs/z7dKgiR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\¿ìѹ\X64\KZipShell.dll
- Size 512KB
- SHA256 014790e04d73ac79bdcb5d4d33bb9d687fee4bba33584d524d649b4142f8e4bf
- MD5 be4b24bd17c88ef4e5a95461c8c96c41
- SHA1 3003617159914a14cec3c7b78fee70c26094025e
- SHA512 c83505bc47563122ef02cc81d07e4e3ef5ac6648a9cdb9907b296378ec21f6c35f438f0269cd92df55150d37169cdd5615f849d30db1bdc41bee8a84f1567b60
- SSDEEP 12288:clUh07If3D7DXS+D2s9JaiUmmu/vVC/kMofN5kAi1NfXE2XERKVW1ro+kYV28fXY:clU8If3D7DC+KEOZs2yyzAWLN3pqsakN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\¿ìѹ\X64\KuaiZipDrive.sys
- Size 90KB
- SHA256 94384ff5849f6350df1a249260f82c6c8061362588fc1057ee498d72b0a709e1
- MD5 1876e8b3f3a1a8ebb1cb6adce66aa56d
- SHA1 34fce38d3ea4551dceecf2784efcaf8baaadd412
- SHA512 80544ccac70bf2eb67e4cae4914449c464c78a0326885fd975e473375655443f3d7e5d6a905286d9b8ddb5d8f35ca14fec96a196be9eae5e3a443c53db3dbe57
- SSDEEP 1536:/nYLKq4xba7Rvj/Nd9sreECUMLaI/wOzIXHG/ns9IUMYq:/nYuB4v5dJECUMLN/bWH2s9IUMT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\¿ìѹ\X64\Lang\Chs_Lang.dll
- Size 182KB
- SHA256 d9f93356f1459fa4352529a3984ddacd774bd44ca54e2c7261b4fed569f21037
- MD5 f4b0f5f11f6c45f9f35683daaf1dc154
- SHA1 66a5a9f11eb488687abd9098bf972b5f140b79ad
- SHA512 6cfb3c8f496b4798c26edb1806f8f82b661e9163c33f7c87578b4f951fc8d3575f15c9e97dbbe2b4e8b53f32213d9f1e20667f6eb97869cc985deee0ff2f318f
- SSDEEP 3072:bCn1pBfAauec8rOMZ24YW4JIpXqOWaohhpGgmg1ATRSQfbVTElwI+LRSi6lqAZdl:epBfA3rpMZdu6qHao4EoSXlqAZdwvAxF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\¿ìѹ\X64\Mount.dll
- Size 139KB
- SHA256 f8a5b80bd4df9b8476ad22c8fff874e986582a1045e166e8cee05cb4f5b80416
- MD5 bb749bff8225c1f4fe637ee9b9900605
- SHA1 9f0259bb8532188bc58d3e0443e8dbcddb0d11f3
- SHA512 74d53797952032bbe4d75b0bd43b3129031306a8060789f44ed2f6100430f82653e4b99fe9ee783c85bf7d8682e4825d1d45da1cb204cb1add49ed7bd9a5a835
- SSDEEP 3072:Q8+Szpy+Vkp3t+gwDZsclUBnX7Vhc9qriIe8CsoIZMhB5ZKbn1UqI:lB10kDZXa7Vhc8+L8TZMhwS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\¿ìѹ\X86\DuiLib.dll
- Size 690KB
- SHA256 b1d2065329687cf7162ca1c303f6418c97b8a9e8914b6c388d834b2318c609be
- MD5 a4dfb3886fd564277b972e0eb6a85d37
- SHA1 65e7065e87630aec7a51dfef744d9a0ff05a475d
- SHA512 4d81770561bbb95dcba4207bc5f1c94acd7f3defb6d82bf427eff08b7aa4360fd28f754015672c8e34cda81bfbd375b9ed9a4707e3276b9b9664eb17ddcafa4b
- SSDEEP 12288:FRjqAnfpo4aw100TbAMoOvO9WveIdQmWwM9cnafmp:Hjql4awFbAMoOvSUQCa+p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\¿ìѹ\X86\KZReport.exe
- Size 934KB
- SHA256 f23c1cfc0e701d0e5c8f2a869b9ab65423e10db7072a0ece5998ae63726f0c35
- MD5 c615fdd832f80a8ff0cff8e3253a6fe9
- SHA1 ca09e99d21e2392e9559a01564c54d0e6f0cfd1b
- SHA512 43c82ae37094fdf2d78352fd66890f25730270602b4821e46ac6b44db653fb2b88ea189a4b7922faccd32f536a14726b1db3308316c76d4c9d5e47414acdb6f5
- SSDEEP 24576:RPQeukcrcFELZHzXLP0I74J5kt1RLFqfNvp:RDuPQELRzXLPZD1RGNvp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\¿ìѹ\X86\KuaiZip.exe
- Size 2.1MB
- SHA256 ccf82a791c6a32ab05622b29fc4fe27199a76b6e923e5f9e0ea14e1dcedf3b61
- MD5 23209cd2c9fb9b1b506cf04732a2fdc9
- SHA1 dcf81ccb7b0ba1ff26bc19ab57b7d1d776acc064
- SHA512 be8f302345259e8ea81d4d02d1e73d6c6127fd574ca604d425a04b63bc8c6be22e7e492f118c43dc791c440b3ec153161dba0117ceaeed2de67618ede9a0eaae
- SSDEEP 49152:UU/ZW/eEwGrzV1ZJBF+imGI8Zs2yyzAWLN3pT8akuWndd7MRCMSfNH6BToy/Z+lz:UiZWmRGrz3+AI7pVH9B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll
- Size 213KB
- SHA256 c115c445731dfc9ac86e03fc46385149abd6da6fdb086092bc711d77c579cd86
- MD5 57dcb435d455facabcbb943df4439211
- SHA1 6cbf59c6a0dd83427104d1d2b02308e23f3bac71
- SHA512 b0334b37dce72f24ab825e376fbec1702476b86978898fe8b1c70d0280781d0353b565b9e2a479bc28a452038a5d49a93cf11b1e81a23870bcfea95ad327782b
- SSDEEP 3072:hxN9aOY8ge11IJJMbtkYhTWcwrj8EeI7kZgE9CCHRx9BEmsxaZiu9W61AorWRVVO:faOfgDJ6horA1GkmE9tHRxQmlWRVVJdW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\¿ìѹ\X86\lang\Chs_Lang.dll
- Size 184KB
- SHA256 f076084d2aca4e6f37b80b950b89eee71339e9d0e7d4a2bea638e58f81dcd34d
- MD5 b97edec9d770cffe2d1ae4c133aeff17
- SHA1 2005bf84b016041c66b39d8b4a6a1713388b3e78
- SHA512 d88c65135fd8f60f8fda581a0c3b1f6eeec50d360793c0ccfe20be9d5d048da88947836bb603a87cadcc0f8b4969b5566285c999471c0e68ee8a047919bd2c8a
- SSDEEP 3072:2TnBJR24YW4JIpXqOWaohhpGgmg1ATRSQfbVTElwI+LUSi6lqAZdMDvAxNW2K:uu6qHao4EZSXlqAZdwvAxNWl
- MD5 SHA1 SHA512 SSDEEP