922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f

General

Target

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
Size

296KB
MD5

4600f8268ca884c291b391dda25849d0
SHA1

dcff33757d2a54f381e6eb498a84dbcf540dc774
SHA256

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f
SHA512

c3203ab728e96dfe8257bf60da608feae27e4ee55e5fb01df9c569a5b44868530b8485d1cf49aa0992b7de08b1993a1dba783230f5fb17df5fc2f25591a6bde2
SSDEEP

6144:uV5tdO1V0uKnvmb7/D26CVrBROjD8R4F0jI+UNc5ynagM/eSpbN1AyllZI4DS7Yq:untdO1V0uKnvmb7/D26lD8R4F0jI+UNN

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exeztdouw.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ztdouw.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe

Executes dropped EXE 1 IoCs

Processes:

ztdouw.exe

pid process

4548 ztdouw.exe

pid	process
4548	ztdouw.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ztdouw.exe922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /t"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /R"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /b"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /y"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /J"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /P"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /Q"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /w"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /Y"	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /u"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /p"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /o"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /S"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /C"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /a"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /m"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /N"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /O"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /Y"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /G"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /I"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /l"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /g"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /h"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /v"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /M"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /f"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /x"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /T"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /c"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /F"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /i"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /W"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /H"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /Z"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /E"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /L"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /K"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /d"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /V"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /e"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /U"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /A"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /B"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /D"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /k"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /X"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /n"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /r"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /s"	ztdouw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ztdouw = "C:\\Users\\Admin\\ztdouw.exe /q"	ztdouw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exeztdouw.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztdouw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exeztdouw.exe

pid	process
3880	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
3880	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe
4548	ztdouw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exeztdouw.exe

pid process

3880 922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
4548 ztdouw.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe

description	pid	process	target process
PID 3880 wrote to memory of 4548	3880	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe	ztdouw.exe
PID 3880 wrote to memory of 4548	3880	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe	ztdouw.exe
PID 3880 wrote to memory of 4548	3880	922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe	ztdouw.exe

C:\Users\Admin\AppData\Local\Temp\922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe
"C:\Users\Admin\AppData\Local\Temp\922e5bdfe56cae648449750335a4bb01a5a8ae5b8bbb7d3289ec9427fc11b37f.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\ztdouw.exe
  "C:\Users\Admin\ztdouw.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\ztdouw.exe

Filesize
296KB

MD5
fd87bbbe7bfb9a938add9a9e7e757ff3

SHA1
36419a62bd4f47c9d672152db6ffca564303d794

SHA256
30d0becb2a61bbcdd39953da5978932207576eaa0ff3d3e172120286c3b4a89e

SHA512
70e1445f2c63523739e79dbb23ce758ce806bd91bedc499feb117ba72f4edc6e0dc99354b9537a194e3eb97f53973c69c0402550ef7d08354eb9296676308343

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads