Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe
-
Size
116KB
-
MD5
7a7dbcd47abc22995bc4455b38a79921
-
SHA1
6ed4722c110c24b1e9f4ee69161d602a3e02a3cb
-
SHA256
a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580
-
SHA512
d46aea86563869e4e31cee419fe7e553e2eb2ccc7c2a894b5d8fcd3b27e699a340e20b4f67fdcf4fb0e6bcd8748baa75255b4726207139bbe843847b9ea7ba5f
-
SSDEEP
768:YtEJb16hRGs6yMtgTVH7NHaurxmWXOQfwoObuPb77eG2:YtE21wml5lXAoO+H7o
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" zoayo.exe -
Executes dropped EXE 1 IoCs
pid Process 892 zoayo.exe -
Loads dropped DLL 2 IoCs
pid Process 1196 a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe 1196 a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ zoayo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\zoayo = "C:\\Users\\Admin\\zoayo.exe" zoayo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe 892 zoayo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1196 a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe 892 zoayo.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 892 1196 a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe 27 PID 1196 wrote to memory of 892 1196 a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe 27 PID 1196 wrote to memory of 892 1196 a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe 27 PID 1196 wrote to memory of 892 1196 a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe 27 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26 PID 892 wrote to memory of 1196 892 zoayo.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe"C:\Users\Admin\AppData\Local\Temp\a85672c225fc733a22759380dd6ae0bed0eb964a46d56a6239634aa109e84580.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\zoayo.exe"C:\Users\Admin\zoayo.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5513cb7b7e338f1c04be298dab20b9bfd
SHA1cec6b76e557be069f11a4584ac9fc8149db9f19f
SHA256ba27dd38215cb47edba174681735b95e54b6144b3ae3be54a3471cfa25f97b50
SHA51282b7bb3289d451482556d8e2967f0340783aa3475da85a3278676086c2e08e8f211315283415136f5dbaed0d783864807d5c742115de3f1130c63871efd98b1d
-
Filesize
116KB
MD5513cb7b7e338f1c04be298dab20b9bfd
SHA1cec6b76e557be069f11a4584ac9fc8149db9f19f
SHA256ba27dd38215cb47edba174681735b95e54b6144b3ae3be54a3471cfa25f97b50
SHA51282b7bb3289d451482556d8e2967f0340783aa3475da85a3278676086c2e08e8f211315283415136f5dbaed0d783864807d5c742115de3f1130c63871efd98b1d
-
Filesize
116KB
MD5513cb7b7e338f1c04be298dab20b9bfd
SHA1cec6b76e557be069f11a4584ac9fc8149db9f19f
SHA256ba27dd38215cb47edba174681735b95e54b6144b3ae3be54a3471cfa25f97b50
SHA51282b7bb3289d451482556d8e2967f0340783aa3475da85a3278676086c2e08e8f211315283415136f5dbaed0d783864807d5c742115de3f1130c63871efd98b1d
-
Filesize
116KB
MD5513cb7b7e338f1c04be298dab20b9bfd
SHA1cec6b76e557be069f11a4584ac9fc8149db9f19f
SHA256ba27dd38215cb47edba174681735b95e54b6144b3ae3be54a3471cfa25f97b50
SHA51282b7bb3289d451482556d8e2967f0340783aa3475da85a3278676086c2e08e8f211315283415136f5dbaed0d783864807d5c742115de3f1130c63871efd98b1d