933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221

General

Target

933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
Size

234KB
MD5

6ed58f353c2b820a48a3d096e0a59c20
SHA1

bd5ee569f23887f7a8f9e98d35c6433a83898911
SHA256

933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221
SHA512

0d6caa7dc495f2c4d9b7f10ac54319ca8306eeae65515665f7d8f02bce52ef43c540ba0beaa5cbbba7a35c5f33807c5fa1f7006d86db80f509c600394f98f589
SSDEEP

3072:RjujS5TRVfzAa4Q4RXSGi0nYTLpRUr94R1R1oiiFF+ZObMzqdjSGlu:vTg5zRXvYROk2iiIObMzqw

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zeeovo.exe

Executes dropped EXE 1 IoCs

pid	Process
1076	zeeovo.exe

Loads dropped DLL 2 IoCs

pid	Process
1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeovo = "C:\\Users\\Admin\\zeeovo.exe /y"	zeeovo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeovo = "C:\\Users\\Admin\\zeeovo.exe /g"	zeeovo.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeovo = "C:\\Users\\Admin\\zeeovo.exe /q"	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeovo = "C:\\Users\\Admin\\zeeovo.exe /m"	zeeovo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeovo = "C:\\Users\\Admin\\zeeovo.exe /h"	zeeovo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeovo = "C:\\Users\\Admin\\zeeovo.exe /k"	zeeovo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeovo = "C:\\Users\\Admin\\zeeovo.exe /v"	zeeovo.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	zeeovo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeovo = "C:\\Users\\Admin\\zeeovo.exe /d"	zeeovo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeovo = "C:\\Users\\Admin\\zeeovo.exe /u"	zeeovo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zeeovo = "C:\\Users\\Admin\\zeeovo.exe /e"	zeeovo.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	zeeovo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	zeeovo.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\c\autorun.inf	zeeovo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe
1076	zeeovo.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
1076	zeeovo.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1076	1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe	28
PID 1788 wrote to memory of 1076	1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe	28
PID 1788 wrote to memory of 1076	1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe	28
PID 1788 wrote to memory of 1076	1788	933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe	28

C:\Users\Admin\AppData\Local\Temp\933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe
"C:\Users\Admin\AppData\Local\Temp\933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\zeeovo.exe
  "C:\Users\Admin\zeeovo.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Drops autorun.inf file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\zeeovo.exe

Filesize
234KB

MD5
6ed58f353c2b820a48a3d096e0a59c20

SHA1
bd5ee569f23887f7a8f9e98d35c6433a83898911

SHA256
933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221

SHA512
0d6caa7dc495f2c4d9b7f10ac54319ca8306eeae65515665f7d8f02bce52ef43c540ba0beaa5cbbba7a35c5f33807c5fa1f7006d86db80f509c600394f98f589

Download Submit
C:\Users\Admin\zeeovo.exe

Filesize
234KB

MD5
6ed58f353c2b820a48a3d096e0a59c20

SHA1
bd5ee569f23887f7a8f9e98d35c6433a83898911

SHA256
933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221

SHA512
0d6caa7dc495f2c4d9b7f10ac54319ca8306eeae65515665f7d8f02bce52ef43c540ba0beaa5cbbba7a35c5f33807c5fa1f7006d86db80f509c600394f98f589

Download Submit
\Users\Admin\zeeovo.exe

Filesize
234KB

MD5
6ed58f353c2b820a48a3d096e0a59c20

SHA1
bd5ee569f23887f7a8f9e98d35c6433a83898911

SHA256
933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221

SHA512
0d6caa7dc495f2c4d9b7f10ac54319ca8306eeae65515665f7d8f02bce52ef43c540ba0beaa5cbbba7a35c5f33807c5fa1f7006d86db80f509c600394f98f589

Download Submit
\Users\Admin\zeeovo.exe

Filesize
234KB

MD5
6ed58f353c2b820a48a3d096e0a59c20

SHA1
bd5ee569f23887f7a8f9e98d35c6433a83898911

SHA256
933f5a2f2d32ee297f684aba2fe82ed00727c84cda16642bdfff0ca1e7ed1221

SHA512
0d6caa7dc495f2c4d9b7f10ac54319ca8306eeae65515665f7d8f02bce52ef43c540ba0beaa5cbbba7a35c5f33807c5fa1f7006d86db80f509c600394f98f589

Download Submit
memory/1788-56-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads