57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337

General

Target

57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe
Size

296KB
MD5

07a692f6972743eca5edc3871fa76a78
SHA1

ab50745a40e8bdcce585f4a5f60ea0b590ceb6de
SHA256

57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337
SHA512

da0c550baf382d269ef5044cbaaf0c6f85738fef7650e3e3dbfc5fc7042443bc2bd21c13c00fb44aa038aaf89f93ed079b207b4dc83fe390739cb491e69f993f
SSDEEP

6144:EzM2xFRGhqb7IT4pO6JK/fObT/bGiWtBcMf1YUQiCgfAJDq2ijxLzOwhd:6DxFRp7IT4pO6JK/fObT/bGiWt/YUQif

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exezouev.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zouev.exe

Executes dropped EXE 1 IoCs

Processes:

zouev.exe

pid process

1776 zouev.exe

pid	process
1776	zouev.exe

Loads dropped DLL 2 IoCs

Processes:

57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe

pid	process
1488	57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe
1488	57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zouev.exe57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /K"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /c"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /q"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /j"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /U"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /I"	57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /R"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /W"	zouev.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /I"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /L"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /o"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /r"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /P"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /u"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /i"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /Q"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /Z"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /m"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /Y"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /a"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /t"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /E"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /l"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /s"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /C"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /f"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /v"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /G"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /n"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /p"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /w"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /H"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /y"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /X"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /z"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /M"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /e"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /d"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /x"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /T"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /h"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /F"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /N"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /D"	zouev.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /O"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /g"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /S"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /J"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /A"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /b"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /B"	zouev.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\zouev = "C:\\Users\\Admin\\zouev.exe /V"	zouev.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exezouev.exe

pid	process
1488	57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe
1776	zouev.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exezouev.exe

pid process

1488 57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe
1776 zouev.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe

description	pid	process	target process
PID 1488 wrote to memory of 1776	1488	57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe	zouev.exe
PID 1488 wrote to memory of 1776	1488	57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe	zouev.exe
PID 1488 wrote to memory of 1776	1488	57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe	zouev.exe
PID 1488 wrote to memory of 1776	1488	57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe	zouev.exe

C:\Users\Admin\AppData\Local\Temp\57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe
"C:\Users\Admin\AppData\Local\Temp\57b90b1a21bb89a34eb784dd926e56d08e4d7d73bca4f83610fc2e5dbb1f8337.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\zouev.exe
"C:\Users\Admin\zouev.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\zouev.exe

Filesize
296KB

MD5
1e109057c5275f1c26f213705a021d4f

SHA1
79f02488de709afccc77468f3a0146adc97c10f4

SHA256
352ce3129e29e476fcac659f517d60c8cbf92eea1a2cb913a39d0aeefcf51d7c

SHA512
90aa599d860dcf7e2a7922076ff80594c760729e32da0afcb71300899e8f4d398b634e6367a4ce849fc5979651782267f865d440a8d861305ebdc7e867b54fef

Download Submit
C:\Users\Admin\zouev.exe

Filesize
296KB

MD5
1e109057c5275f1c26f213705a021d4f

SHA1
79f02488de709afccc77468f3a0146adc97c10f4

SHA256
352ce3129e29e476fcac659f517d60c8cbf92eea1a2cb913a39d0aeefcf51d7c

SHA512
90aa599d860dcf7e2a7922076ff80594c760729e32da0afcb71300899e8f4d398b634e6367a4ce849fc5979651782267f865d440a8d861305ebdc7e867b54fef

Download Submit
\Users\Admin\zouev.exe

Filesize
296KB

MD5
1e109057c5275f1c26f213705a021d4f

SHA1
79f02488de709afccc77468f3a0146adc97c10f4

SHA256
352ce3129e29e476fcac659f517d60c8cbf92eea1a2cb913a39d0aeefcf51d7c

SHA512
90aa599d860dcf7e2a7922076ff80594c760729e32da0afcb71300899e8f4d398b634e6367a4ce849fc5979651782267f865d440a8d861305ebdc7e867b54fef

Download Submit
\Users\Admin\zouev.exe

Filesize
296KB

MD5
1e109057c5275f1c26f213705a021d4f

SHA1
79f02488de709afccc77468f3a0146adc97c10f4

SHA256
352ce3129e29e476fcac659f517d60c8cbf92eea1a2cb913a39d0aeefcf51d7c

SHA512
90aa599d860dcf7e2a7922076ff80594c760729e32da0afcb71300899e8f4d398b634e6367a4ce849fc5979651782267f865d440a8d861305ebdc7e867b54fef

Download Submit
memory/1488-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1776-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads