zeppelin | 8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee

Analysis

max time kernel
127s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-01-2023 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5.exe
Size

218KB
MD5

b8845a76e3942ff4d20ba4660ae926bb
SHA1

eb90f945087c270a2ecc11753180ba4ecc270696
SHA256

8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee
SHA512

9e2eda3dfe3bbdf149707eefe67d889fc88e0aa45ae23023367a8914b8feabd1badb043dfb5f8301541d4489d31b79164380a5ac8031662156c639008c26c4fc
SSDEEP

6144:aC61i972rJmciP98f2H64DQFu/U3buRKlemZ9DnGAe/Ix3Sd7+:aK972I/Gf2a4DQFu/U3buRKlemZ9DnG9

Score

10^/10

zeppelin persistence ransomware

Malware Config

Signatures

Detects Zeppelin payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e2b3-133.dat	family_zeppelin
behavioral2/files/0x000300000001e2b3-134.dat	family_zeppelin

Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
ransomware zeppelin

Executes dropped EXE 1 IoCs

pid	Process
2800	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run	5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\svchost.exe\" -start"	5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4972	2800	WerFault.exe	82

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe
2800	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2780	5.exe
Token: SeDebugPrivilege	2780	5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2800	2780	5.exe	82
PID 2780 wrote to memory of 2800	2780	5.exe	82
PID 2780 wrote to memory of 2800	2780	5.exe	82
PID 2780 wrote to memory of 4448	2780	5.exe	83
PID 2780 wrote to memory of 4448	2780	5.exe	83
PID 2780 wrote to memory of 4448	2780	5.exe	83
PID 2780 wrote to memory of 4448	2780	5.exe	83
PID 2780 wrote to memory of 4448	2780	5.exe	83
PID 2780 wrote to memory of 4448	2780	5.exe	83

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -start
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 756
    3⤵
    - Program crash
    PID:4972
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  PID:4448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2800 -ip 2800
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe

Filesize
218KB

MD5
b8845a76e3942ff4d20ba4660ae926bb

SHA1
eb90f945087c270a2ecc11753180ba4ecc270696

SHA256
8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee

SHA512
9e2eda3dfe3bbdf149707eefe67d889fc88e0aa45ae23023367a8914b8feabd1badb043dfb5f8301541d4489d31b79164380a5ac8031662156c639008c26c4fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe

Filesize
218KB

MD5
b8845a76e3942ff4d20ba4660ae926bb

SHA1
eb90f945087c270a2ecc11753180ba4ecc270696

SHA256
8ab79654152668be2c10be9cb17d941685e7733628dd7d38d6979516a75682ee

SHA512
9e2eda3dfe3bbdf149707eefe67d889fc88e0aa45ae23023367a8914b8feabd1badb043dfb5f8301541d4489d31b79164380a5ac8031662156c639008c26c4fc

Download Submit