Analysis
-
max time kernel
164s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 17:01
Static task
static1
Behavioral task
behavioral1
Sample
a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe
Resource
win10v2004-20221111-en
General
-
Target
a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe
-
Size
288KB
-
MD5
43848de123fc679e24f9b72564dec04c
-
SHA1
9536b49224461b68068c74ce33646300e0574beb
-
SHA256
a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b
-
SHA512
df0cbe2143642d48f811f81a8c1d3030c069733801d2aec550656aacc4c9e5de51f0e5978a6f5a78192af5e4bd9743994a2b1e8b1f7fa6995127bf9c842febb6
-
SSDEEP
6144:oIsiuvbGuOdn9Z/QmO6Ckobf3fGCmahGIUutj:duvbGuYnXQmO6Ckobf3fGCmahTUs
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
zlnen.exea994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zlnen.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe -
Executes dropped EXE 1 IoCs
Processes:
zlnen.exepid process 1096 zlnen.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe -
Adds Run key to start application 2 TTPs 52 IoCs
Processes:
zlnen.exea994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /S" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /G" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /e" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /a" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /p" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /Q" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /J" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /D" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /o" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /E" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /x" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /c" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /u" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /n" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /i" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /H" zlnen.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /s" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /f" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /t" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /A" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /y" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /N" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /d" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /r" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /T" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /v" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /I" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /m" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /F" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /Z" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /W" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /O" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /Y" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /g" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /M" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /z" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /P" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /K" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /k" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /X" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /L" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /w" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /q" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /j" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /P" a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run\ zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /B" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /C" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /V" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /U" zlnen.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zlnen = "C:\\Users\\Admin\\zlnen.exe /h" zlnen.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exezlnen.exepid process 4536 a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe 4536 a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe 1096 zlnen.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exezlnen.exepid process 4536 a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe 1096 zlnen.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exedescription pid process target process PID 4536 wrote to memory of 1096 4536 a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe zlnen.exe PID 4536 wrote to memory of 1096 4536 a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe zlnen.exe PID 4536 wrote to memory of 1096 4536 a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe zlnen.exe PID 4536 wrote to memory of 1096 4536 a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe zlnen.exe PID 4536 wrote to memory of 1096 4536 a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe zlnen.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe"C:\Users\Admin\AppData\Local\Temp\a994e4b9dd4a61a4a387b2a04ed299a7842a57d674d3e05002934ad29867570b.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\zlnen.exe"C:\Users\Admin\zlnen.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1096
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\zlnen.exeFilesize
288KB
MD54f7ffd1cb967b34bcbf1a8d39210840a
SHA1bbce28d905c0367a1a9fc4c4ace866c910a6d4a5
SHA256bc7b9c99a7083556003f976b311850c0f89f395df588a7196624f04280496173
SHA512663d73e93c34805e8130acd43deb8a8273dce79842b8b45119ad96785f3fe6a2c3dbbb69e610c5ffb34bda239bf637c862ed2083e496d094266770412fcd206c
-
C:\Users\Admin\zlnen.exeFilesize
288KB
MD54f7ffd1cb967b34bcbf1a8d39210840a
SHA1bbce28d905c0367a1a9fc4c4ace866c910a6d4a5
SHA256bc7b9c99a7083556003f976b311850c0f89f395df588a7196624f04280496173
SHA512663d73e93c34805e8130acd43deb8a8273dce79842b8b45119ad96785f3fe6a2c3dbbb69e610c5ffb34bda239bf637c862ed2083e496d094266770412fcd206c
-
memory/1096-135-0x0000000000000000-mapping.dmp
-
memory/1096-140-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/1096-141-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/4536-134-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB