e198a1cf6988b3e8bffa5dec0b28c891c5ef4116c71fbc94d9a68ed9e9b444eb

Resubmissions

23-01-2023 13:41

230123-qzjg9add79 10

27-12-2022 17:22

221227-vxl8ksfd97 10

27-12-2022 17:10

221227-vprhbsae8t 10

Analysis

max time kernel
302s
max time network
337s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2022 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zsys-master/cmd/zsysd/daemon/zsysd.go
Size

1KB
MD5

3146e54f56c714926348c3219dbfa792
SHA1

fede1277cb39e75eb48e8e4926a58cc5838eb237
SHA256

63138d5228817bf08f010ceddaacf6d8b689b92bb83a0ddecd3c2bae25886760
SHA512

9fba4dc876197a2d52159f291f2b04100bb700f490312648f88c04e06673e3600edfe0fa006378fdaa194886d9c0cb6630c02eabc309ceed4f0042bf11e483a5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

1628 OpenWith.exe

pid	process
1628	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\zsys-master\cmd\zsysd\daemon\zsysd.go
1⤵
- Modifies registry class
PID:3692

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads