Analysis
-
max time kernel
151s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 19:50
Static task
static1
Behavioral task
behavioral1
Sample
f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe
-
Size
280KB
-
MD5
0252bfd7bb98bef27bce1ab573108992
-
SHA1
eb70f5aaf8c4c175a34fe6092c1bb341ec2b4e68
-
SHA256
f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e
-
SHA512
7c92bcae3a183836c544d009b206b7a844e52924df0b36a5b6964328d2e493331c53d70d8f598c05f33eb2bd231277e880fb357fd7a7d52a19d173d29692b3ab
-
SSDEEP
6144:KIVIpydVsZyxyK5R8GYKi1Xfvs1tzH51t+ewSReXNL/B:ruydfiebOTB
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zeomaa.exe -
Executes dropped EXE 1 IoCs
pid Process 4868 zeomaa.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe -
Adds Run key to start application 2 TTPs 54 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /R" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /a" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /F" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /j" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /E" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /I" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /d" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /q" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /K" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /N" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /W" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /o" zeomaa.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /L" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /H" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /B" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /D" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /U" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /X" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /G" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /Z" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /Y" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /V" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /w" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /e" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /r" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /A" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /g" f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /h" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /k" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /g" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /c" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /m" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /C" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /l" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /u" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /J" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /t" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /x" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /s" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /T" zeomaa.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\ zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /b" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /v" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /i" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /S" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /f" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /O" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /M" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /y" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /n" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /P" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /Q" zeomaa.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zeomaa = "C:\\Users\\Admin\\zeomaa.exe /p" zeomaa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3340 f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe 3340 f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe 4868 zeomaa.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3340 f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe 4868 zeomaa.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3340 wrote to memory of 4868 3340 f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe 80 PID 3340 wrote to memory of 4868 3340 f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe 80 PID 3340 wrote to memory of 4868 3340 f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe"C:\Users\Admin\AppData\Local\Temp\f4bfa30450197d90a5bbb5bc8eb0adae466350c4aefe004b56945d262eaf384e.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\zeomaa.exe"C:\Users\Admin\zeomaa.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4868
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD5ebf67c118bf946f9606b606a87423b72
SHA1a312240572ea60e9ed136a753095ad4a4fa55040
SHA25651cdeab5c1244c7e964d7b453adf29714dc80f8c4fe99844053acc44de0e3b87
SHA5120f620732cd70edea21d39607c212722d6dadd527b8e935f8a3fe0d8a2bb15bc96e8acac3e5b325b406636229daceb36f39b70314821d453af30fd3eb15450fb7
-
Filesize
280KB
MD5ebf67c118bf946f9606b606a87423b72
SHA1a312240572ea60e9ed136a753095ad4a4fa55040
SHA25651cdeab5c1244c7e964d7b453adf29714dc80f8c4fe99844053acc44de0e3b87
SHA5120f620732cd70edea21d39607c212722d6dadd527b8e935f8a3fe0d8a2bb15bc96e8acac3e5b325b406636229daceb36f39b70314821d453af30fd3eb15450fb7