Analysis
-
max time kernel
187s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 23:54
Static task
static1
Behavioral task
behavioral1
Sample
eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe
-
Size
100KB
-
MD5
925b91661d2fa7922a1320f1ea659de1
-
SHA1
06dcbaca995e1db0de92afb654121068a519eff2
-
SHA256
eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c
-
SHA512
2aa5fedeb52b7c8caff7a6e3a687a73a23ec1e901e9eddaac346b211a677ebef4d47fddc9ad8a2122280e8f86f05d77ab7c56bd9b4bd53f052aa24c861615e63
-
SSDEEP
1536:1bY8iAuismyws8iLw0wF9MGM9K/oKtNgCMbA1bL3N+NM5UfaNIjnZmb:Cd/KLOM5pCnYb
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ziaba.exe -
Executes dropped EXE 1 IoCs
pid Process 1732 ziaba.exe -
Loads dropped DLL 2 IoCs
pid Process 1676 eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe 1676 eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe -
Adds Run key to start application 2 TTPs 51 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /i" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /d" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /F" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /k" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /G" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /I" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /E" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /b" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /g" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /T" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /N" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /q" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /p" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /J" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /S" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /n" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /m" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /Z" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /l" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /j" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /R" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /r" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /D" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /B" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /Q" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /C" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /x" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /A" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /V" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /s" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /y" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /M" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /H" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /e" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /O" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /u" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /v" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /p" eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /f" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /c" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /o" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /P" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /L" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /X" ziaba.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /Y" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /U" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /t" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /h" ziaba.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziaba = "C:\\Users\\Admin\\ziaba.exe /w" ziaba.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ziaba.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1676 eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe 1732 ziaba.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1676 eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe 1732 ziaba.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1676 wrote to memory of 1732 1676 eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe 27 PID 1676 wrote to memory of 1732 1676 eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe 27 PID 1676 wrote to memory of 1732 1676 eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe 27 PID 1676 wrote to memory of 1732 1676 eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe"C:\Users\Admin\AppData\Local\Temp\eca3858443297fda6dc124edd142916813a372390715b52182b91ccda5aec87c.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\ziaba.exe"C:\Users\Admin\ziaba.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1732
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD51c6594c901d3846ef30f07688b972fbb
SHA11bb7e28ad28e997eb330966ecbfac79a5d59fdb2
SHA256a9846f5db4f0801480c4ed4dfbc7fa12a06a2c810ea023839df6ae3cc21d6580
SHA51209a47f86c0f32ca4380ae887df30c1a8e92367df7f45f99d8e5fc8210df0c1a72c5a15897206d7196b1eac5ccf2540d7ff3c3fe29817abb016b8e8256d671bf5
-
Filesize
100KB
MD51c6594c901d3846ef30f07688b972fbb
SHA11bb7e28ad28e997eb330966ecbfac79a5d59fdb2
SHA256a9846f5db4f0801480c4ed4dfbc7fa12a06a2c810ea023839df6ae3cc21d6580
SHA51209a47f86c0f32ca4380ae887df30c1a8e92367df7f45f99d8e5fc8210df0c1a72c5a15897206d7196b1eac5ccf2540d7ff3c3fe29817abb016b8e8256d671bf5
-
Filesize
100KB
MD51c6594c901d3846ef30f07688b972fbb
SHA11bb7e28ad28e997eb330966ecbfac79a5d59fdb2
SHA256a9846f5db4f0801480c4ed4dfbc7fa12a06a2c810ea023839df6ae3cc21d6580
SHA51209a47f86c0f32ca4380ae887df30c1a8e92367df7f45f99d8e5fc8210df0c1a72c5a15897206d7196b1eac5ccf2540d7ff3c3fe29817abb016b8e8256d671bf5
-
Filesize
100KB
MD51c6594c901d3846ef30f07688b972fbb
SHA11bb7e28ad28e997eb330966ecbfac79a5d59fdb2
SHA256a9846f5db4f0801480c4ed4dfbc7fa12a06a2c810ea023839df6ae3cc21d6580
SHA51209a47f86c0f32ca4380ae887df30c1a8e92367df7f45f99d8e5fc8210df0c1a72c5a15897206d7196b1eac5ccf2540d7ff3c3fe29817abb016b8e8256d671bf5