e198a1cf6988b3e8bffa5dec0b28c891c5ef4116c71fbc94d9a68ed9e9b444eb

Resubmissions

23-01-2023 13:41

230123-qzjg9add79 10

27-12-2022 17:22

221227-vxl8ksfd97 10

27-12-2022 17:10

221227-vprhbsae8t 10

Analysis

max time kernel
369s
max time network
410s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2022 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zsys-master/.gitignore
Size

363B
MD5

aebeb236fcd050aaa2620c6c9fa7a711
SHA1

96dbd9f077ec95c03a0dcc65748accc794191e87
SHA256

6c03e319cabb39954fd6e23acea8e70e1f39eea82e7a195f51cd8bb6b9a13198
SHA512

c1c715e6b1c535c820a389a9138c5ad528750b696887dde8301e19c3dcbcec0fa235f4c8556f06c8537a1515bd6d66448287c221eefc9a40aea10ea1bd4e2a91

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

cmd.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

OpenWith.exe

pid process

392 OpenWith.exe
392 OpenWith.exe
392 OpenWith.exe
392 OpenWith.exe
392 OpenWith.exe
392 OpenWith.exe
392 OpenWith.exe
392 OpenWith.exe
392 OpenWith.exe
Suspicious use of WriteProcessMemory 2 IoCs

Processes:

OpenWith.exe

description pid process target process

PID 392 wrote to memory of 912 392 OpenWith.exe NOTEPAD.EXE
PID 392 wrote to memory of 912 392 OpenWith.exe NOTEPAD.EXE

pid	process
392	OpenWith.exe
392	OpenWith.exe
392	OpenWith.exe
392	OpenWith.exe
392	OpenWith.exe
392	OpenWith.exe
392	OpenWith.exe
392	OpenWith.exe
392	OpenWith.exe

description	pid	process	target process
PID 392 wrote to memory of 912	392	OpenWith.exe	NOTEPAD.EXE
PID 392 wrote to memory of 912	392	OpenWith.exe	NOTEPAD.EXE

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\zsys-master\.gitignore
1⤵
- Modifies registry class
PID:4624

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\zsys-master\.gitignore
2⤵
PID:912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/912-132-0x0000000000000000-mapping.dmp

Download