6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4

General

Target

6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe
Size

116KB
MD5

586365c2affcb632145b82d813e59bcd
SHA1

0a2203e7f5904f7bab741d66b30d1f5fdb00861b
SHA256

6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4
SHA512

da1ba8c3dfd074b63f1f67f909e799dab4c1e9b9003c8014e2de716a7e8fae473ba553f5086138d52069a113e51f77a236500c10b2366989306b22aedf0af713
SSDEEP

1536:1bXuJaDBeZjhtFgGjtXDTto2D9uCLBCPr8/NL44PerViI8kIi/p0:peJIeZj/FgoTq2lr20

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exeziedaiq.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	ziedaiq.exe

Executes dropped EXE 1 IoCs

Processes:

ziedaiq.exe

pid process

936 ziedaiq.exe

pid	process
936	ziedaiq.exe

Loads dropped DLL 2 IoCs

Processes:

6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe

pid	process
1952	6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe
1952	6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ziedaiq.exe6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /k"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /d"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /j"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /e"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /n"	6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /p"	ziedaiq.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /w"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /c"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /r"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /u"	ziedaiq.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /x"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /s"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /b"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /v"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /z"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /a"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /g"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /o"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /h"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /l"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /f"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /m"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /i"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /t"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /n"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /y"	ziedaiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziedaiq = "C:\\Users\\Admin\\ziedaiq.exe /q"	ziedaiq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exeziedaiq.exe

pid	process
1952	6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe
936	ziedaiq.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exeziedaiq.exe

pid process

1952 6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe
936 ziedaiq.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe

description	pid	process	target process
PID 1952 wrote to memory of 936	1952	6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe	ziedaiq.exe
PID 1952 wrote to memory of 936	1952	6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe	ziedaiq.exe
PID 1952 wrote to memory of 936	1952	6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe	ziedaiq.exe
PID 1952 wrote to memory of 936	1952	6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe	ziedaiq.exe

C:\Users\Admin\AppData\Local\Temp\6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe
"C:\Users\Admin\AppData\Local\Temp\6a832a43858b46fbf848ea9bb8efc74633f2ee33be82b0be9801556e65b8b8c4.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\ziedaiq.exe
"C:\Users\Admin\ziedaiq.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\ziedaiq.exe
Filesize
116KB

MD5
4e2dd8901fe4e65ff5d1c197e6369154

SHA1
a6f92451b9489d895a1f72e72f8e7c171b1bbd02

SHA256
97cee5c19f7223bcaa9d7c27b82a10acdfa91ccbd6f6a18217c351a9649b1fe6

SHA512
1dd4eec250193034bdab95032ea65bc561379538a2a0d38bc94ae75166c8be7e80f9ea19c8850774384e84d9cd4ea3221a9b729e836aa1abea288a3f95cb0354

Download Submit
C:\Users\Admin\ziedaiq.exe
Filesize
116KB

MD5
4e2dd8901fe4e65ff5d1c197e6369154

SHA1
a6f92451b9489d895a1f72e72f8e7c171b1bbd02

SHA256
97cee5c19f7223bcaa9d7c27b82a10acdfa91ccbd6f6a18217c351a9649b1fe6

SHA512
1dd4eec250193034bdab95032ea65bc561379538a2a0d38bc94ae75166c8be7e80f9ea19c8850774384e84d9cd4ea3221a9b729e836aa1abea288a3f95cb0354

Download Submit
\Users\Admin\ziedaiq.exe
Filesize
116KB

MD5
4e2dd8901fe4e65ff5d1c197e6369154

SHA1
a6f92451b9489d895a1f72e72f8e7c171b1bbd02

SHA256
97cee5c19f7223bcaa9d7c27b82a10acdfa91ccbd6f6a18217c351a9649b1fe6

SHA512
1dd4eec250193034bdab95032ea65bc561379538a2a0d38bc94ae75166c8be7e80f9ea19c8850774384e84d9cd4ea3221a9b729e836aa1abea288a3f95cb0354

Download Submit
\Users\Admin\ziedaiq.exe
Filesize
116KB

MD5
4e2dd8901fe4e65ff5d1c197e6369154

SHA1
a6f92451b9489d895a1f72e72f8e7c171b1bbd02

SHA256
97cee5c19f7223bcaa9d7c27b82a10acdfa91ccbd6f6a18217c351a9649b1fe6

SHA512
1dd4eec250193034bdab95032ea65bc561379538a2a0d38bc94ae75166c8be7e80f9ea19c8850774384e84d9cd4ea3221a9b729e836aa1abea288a3f95cb0354

Download Submit
memory/936-59-0x0000000000000000-mapping.dmp

Download
memory/1952-54-0x0000000075981000-0x0000000075983000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads