c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df

General

Target

c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe
Size

184KB
MD5

52616d239c0a3bacef695459e7f3449c
SHA1

9525cf92e6b3bfbbe1109a195eea97af0fa380df
SHA256

c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df
SHA512

40ede96ea3248c9ca6d2ebcb417bec428845cbb537e849a4bf5151f5c181df07b6d49f10df5bde09926b1b92e7e4e3655085e323a06af234d6a2d3e4f723cb2a
SSDEEP

3072:30FEOW7fEQVdXpAxTIfJyX33RPvSk8g0gVTRj:30P2Zd5ARIfA3lvStgtV

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exezpsoop.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zpsoop.exe

Executes dropped EXE 1 IoCs

Processes:

zpsoop.exe

pid process

1176 zpsoop.exe

pid	process
1176	zpsoop.exe

Loads dropped DLL 2 IoCs

Processes:

c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe

pid	process
832	c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe
832	c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zpsoop.exec70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /t"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /F"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /N"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /M"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /B"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /Z"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /T"	c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /W"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /s"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /f"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /k"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /n"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /T"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /z"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /b"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /U"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /L"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /w"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /D"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /O"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /I"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /h"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /u"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /d"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /R"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /J"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /m"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /r"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /S"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /p"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /Y"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /x"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /c"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /Q"	zpsoop.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /P"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /g"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /q"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /V"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /j"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /G"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /o"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /A"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /K"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /H"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /a"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /X"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /y"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /v"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /E"	zpsoop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /i"	zpsoop.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpsoop = "C:\\Users\\Admin\\zpsoop.exe /e"	zpsoop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exezpsoop.exe

pid	process
832	c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe
1176	zpsoop.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exezpsoop.exe

pid process

832 c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe
1176 zpsoop.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe

description	pid	process	target process
PID 832 wrote to memory of 1176	832	c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe	zpsoop.exe
PID 832 wrote to memory of 1176	832	c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe	zpsoop.exe
PID 832 wrote to memory of 1176	832	c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe	zpsoop.exe
PID 832 wrote to memory of 1176	832	c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe	zpsoop.exe

C:\Users\Admin\AppData\Local\Temp\c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe
"C:\Users\Admin\AppData\Local\Temp\c70b0e90be88882c3fb7e2ceee54c1314f8fd2c3213c2b29ceb9555acea3c6df.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\zpsoop.exe
  "C:\Users\Admin\zpsoop.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\zpsoop.exe

Filesize
184KB

MD5
b0f13125c1383ab62ad6c7b33195b1a2

SHA1
94276e1e20d9c84de6b65a4b01a78b3e1a8b7c7a

SHA256
d3fdcb7fddfa2e2702946cf61cc3671f03db76857dad64b3eceb4a056a31ac53

SHA512
85e3f7837f6321bb04fcdd181f71b4f4de87d7a9e2d2d03cdecc21e56747748598f39005989c41974f5d9316c3328f0ba1d223c596c4ee4ddd78decc4febfd4b

Download Submit
C:\Users\Admin\zpsoop.exe

Filesize
184KB

MD5
b0f13125c1383ab62ad6c7b33195b1a2

SHA1
94276e1e20d9c84de6b65a4b01a78b3e1a8b7c7a

SHA256
d3fdcb7fddfa2e2702946cf61cc3671f03db76857dad64b3eceb4a056a31ac53

SHA512
85e3f7837f6321bb04fcdd181f71b4f4de87d7a9e2d2d03cdecc21e56747748598f39005989c41974f5d9316c3328f0ba1d223c596c4ee4ddd78decc4febfd4b

Download Submit
\Users\Admin\zpsoop.exe

Filesize
184KB

MD5
b0f13125c1383ab62ad6c7b33195b1a2

SHA1
94276e1e20d9c84de6b65a4b01a78b3e1a8b7c7a

SHA256
d3fdcb7fddfa2e2702946cf61cc3671f03db76857dad64b3eceb4a056a31ac53

SHA512
85e3f7837f6321bb04fcdd181f71b4f4de87d7a9e2d2d03cdecc21e56747748598f39005989c41974f5d9316c3328f0ba1d223c596c4ee4ddd78decc4febfd4b

Download Submit
\Users\Admin\zpsoop.exe

Filesize
184KB

MD5
b0f13125c1383ab62ad6c7b33195b1a2

SHA1
94276e1e20d9c84de6b65a4b01a78b3e1a8b7c7a

SHA256
d3fdcb7fddfa2e2702946cf61cc3671f03db76857dad64b3eceb4a056a31ac53

SHA512
85e3f7837f6321bb04fcdd181f71b4f4de87d7a9e2d2d03cdecc21e56747748598f39005989c41974f5d9316c3328f0ba1d223c596c4ee4ddd78decc4febfd4b

Download Submit
memory/832-56-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1176-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads