Overview

overview

10

Static

static

ioxyfx.dat.exe

windows7_x64

10

ioxyfx.dat.exe

windows10_x64

10

Resubmissions

20-09-2020 09:53

200920-9rh6v6y6ga 10

20-09-2020 09:09

200920-94a3wvdaln 10

20-09-2020 07:26

200920-gyqrj2hcqj 10

20-09-2020 07:11

200920-xak2q5j4ha 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ioxyfx.dat

  • Size

    7.1MB

  • Sample

    200920-xak2q5j4ha

  • MD5

    d5f9fa1a8dca5319432f51a5891f7794

  • SHA1

    2a937328f5b99eccb9b8c13ed71d6ffb9dff4521

  • SHA256

    18f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055

  • SHA512

    87013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0

Score
10/10
zhendiscoveryevasionexploitpersistenceransomwarespyware

Malware Config

Targets

    • Target

      ioxyfx.dat

    • Size

      7.1MB

    • MD5

      d5f9fa1a8dca5319432f51a5891f7794

    • SHA1

      2a937328f5b99eccb9b8c13ed71d6ffb9dff4521

    • SHA256

      18f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055

    • SHA512

      87013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0

    Score
    10/10
    spywareransomwarediscoveryexploitpersistencezhenevasion

    • Deletes Windows Defender Definitions

      Uses mpcmdrun utility to delete all AV definitions.

      evasion

    • Zhen Ransomware

      First seen in September 2020. Drops ransomnote as .ini file.

      ransomwarezhen

    • Executes dropped EXE

    • Modifies extensions of user files

      Ransomware generally changes the extension on encrypted files.

      ransomware

    • Possible privilege escalation attempt

      exploit

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Modifies service

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

1
T1089

File Permissions Modification

1
T1222

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks