d4c62215df74753371db33a19a69fccdc4b375c893a4b7f8b30172710fbd4cfa

Resubmissions

10/06/2023, 20:48

230610-zlyjpage81 8

10/06/2023, 20:47

230610-zk964age8z 6

Analysis

max time kernel
66s
max time network
77s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
10/06/2023, 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zero.exe
Size

398KB
MD5

bd0a3c308a6d3372817a474b7c653097
SHA1

5ed36132872be3d5d94627b89f15a7369f68fba1
SHA256

d4c62215df74753371db33a19a69fccdc4b375c893a4b7f8b30172710fbd4cfa
SHA512

86c53974da682c9e55a181cacc3ba19a9bfd8df488c536c175695f28f79bb586722f4d6b061aaceb9d0db91996dd0a7e288f413c7d2562fbc5b6a305f747368f
SSDEEP

6144:tYcn3ge+gqzsSALff2TRLz1lTl8TFPUW+8sSZJMidVmXmVcXHU:ttQe+PzsfX2Tpz1daaWnVIgcE

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\FileRescue = "C:\\ZeroLocker\\ZeroRescue.exe"	zero.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	zero.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	zero.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	zero.exe
File opened for modification	C:\Windows\assembly	zero.exe
File created	C:\Windows\assembly\Desktop.ini	zero.exe

C:\Users\Admin\AppData\Local\Temp\zero.exe
"C:\Users\Admin\AppData\Local\Temp\zero.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Windows directory
PID:4156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4156-117-0x0000000000960000-0x00000000009C8000-memory.dmp

Filesize
416KB

Download
memory/4156-118-0x0000000002A40000-0x0000000002A50000-memory.dmp

Filesize
64KB

Download
memory/4156-119-0x000000001B870000-0x000000001B8B2000-memory.dmp

Filesize
264KB

Download
memory/4156-122-0x000000001BA80000-0x000000001BB26000-memory.dmp

Filesize
664KB

Download
memory/4156-123-0x000000001C000000-0x000000001C4CE000-memory.dmp

Filesize
4.8MB

Download
memory/4156-124-0x000000001C5E0000-0x000000001C67C000-memory.dmp

Filesize
624KB

Download
memory/4156-125-0x0000000002A20000-0x0000000002A28000-memory.dmp

Filesize
32KB

Download
memory/4156-126-0x000000001C740000-0x000000001C78C000-memory.dmp

Filesize
304KB

Download
memory/4156-127-0x0000000002A40000-0x0000000002A50000-memory.dmp

Filesize
64KB

Download
memory/4156-128-0x0000000002A40000-0x0000000002A50000-memory.dmp

Filesize
64KB

Download