Analysis
-
max time kernel
69s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
17/04/2023, 14:47 UTC
General
-
Target
theZoo-master/imports/terminal_handler.py
-
Size
6KB
-
MD5
8607a2b55eeb72569f6b040ce9eab020
-
SHA1
035e869ba246d9000b7074d0c5c9f602d3110c9e
-
SHA256
ede24040ef72dbcfcb322bf492891b3dc40036996252cc770a53074bd15ba154
-
SHA512
4add13620a54781c6b35f30a117c49ed0f87466b24d568d7097d4581335ad82f40813911f5f5d156a4b12daab6bfbf6382fe77eca88891ab025a5eb1cefdc298
-
SSDEEP
96:0nJX0rVshjW+31xNwwS8pymrEpfMNtBSBT6HUNBzC9uKOtAF9EcCEZirrWb:0nThjW+9wwBpYUBQ8olkse9Sro
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\theZoo-master\imports\terminal_handler.py1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
-
DNS55.37.195.20.in-addr.arpaRemote address:8.8.8.8:53Request55.37.195.20.in-addr.arpaIN PTRResponse -
DNS198.209.218.23.in-addr.arpaRemote address:8.8.8.8:53Request198.209.218.23.in-addr.arpaIN PTRResponse198.209.218.23.in-addr.arpaIN PTRa23-218-209-198deploystaticakamaitechnologiescom
-
DNS97.17.167.52.in-addr.arpaRemote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
DNS73.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request73.159.190.20.in-addr.arpaIN PTRResponse
-
DNS44.8.109.52.in-addr.arpaRemote address:8.8.8.8:53Request44.8.109.52.in-addr.arpaIN PTRResponse
-
DNS123.108.74.40.in-addr.arpaRemote address:8.8.8.8:53Request123.108.74.40.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
209.197.3.8:80
-
93.184.220.29:80
-
20.189.173.5:443
-
209.197.3.8:80
-
209.197.3.8:80
-
8.8.8.8:5355.37.195.20.in-addr.arpadns
DNS Request
55.37.195.20.in-addr.arpa
-
8.8.8.8:53198.209.218.23.in-addr.arpadns
DNS Request
198.209.218.23.in-addr.arpa
-
8.8.8.8:5397.17.167.52.in-addr.arpadns
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:5373.159.190.20.in-addr.arpadns
DNS Request
73.159.190.20.in-addr.arpa
-
8.8.8.8:5344.8.109.52.in-addr.arpadns
DNS Request
44.8.109.52.in-addr.arpa
-
8.8.8.8:53123.108.74.40.in-addr.arpadns
DNS Request
123.108.74.40.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa