ae5bd505c20878ddbb8a2b9c2c0dc687d2168bfc83e563442f2a89ea14601f57

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2023 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZANTE - VESSEL'S PARTICULARS.exe
Size

625KB
MD5

4ea040df51267d35a686217df9619599
SHA1

7dbe82acfe0b211d25cd0c4eaf1b87b7de3fdf9c
SHA256

ae5bd505c20878ddbb8a2b9c2c0dc687d2168bfc83e563442f2a89ea14601f57
SHA512

26e89f6888736ca34ffc3b77637a802d5b8c3c3a74fdd2e09f3b84a341bfaf8d6d76eb42da9bb8d31e3bd3b2e255ca6d6a612e08e304e3be1861eb72d01ee275
SSDEEP

12288:ZYD70GBqHALOGDy/ikPJTeRJvyeiaVPKUNKXW7dg90hTdguoTgDO3sUvF0:ZYD70dW+/LP9YJaeFVEud2EDOp0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2624	zndyx.exe
4124	zndyx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2624 set thread context of 4124	2624	zndyx.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1672	4124	WerFault.exe	85

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2624	zndyx.exe
2624	zndyx.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2624	zndyx.exe
2624	zndyx.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2624	zndyx.exe
2624	zndyx.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 2624	4284	ZANTE - VESSEL'S PARTICULARS.exe	84
PID 4284 wrote to memory of 2624	4284	ZANTE - VESSEL'S PARTICULARS.exe	84
PID 4284 wrote to memory of 2624	4284	ZANTE - VESSEL'S PARTICULARS.exe	84
PID 2624 wrote to memory of 4124	2624	zndyx.exe	85
PID 2624 wrote to memory of 4124	2624	zndyx.exe	85
PID 2624 wrote to memory of 4124	2624	zndyx.exe	85
PID 2624 wrote to memory of 4124	2624	zndyx.exe	85

C:\Users\Admin\AppData\Local\Temp\ZANTE - VESSEL'S PARTICULARS.exe
"C:\Users\Admin\AppData\Local\Temp\ZANTE - VESSEL'S PARTICULARS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Temp\zndyx.exe
  "C:\Users\Admin\AppData\Local\Temp\zndyx.exe" "C:\Users\Admin\AppData\Local\Temp\hxroji.au3"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\zndyx.exe
    "C:\Users\Admin\AppData\Local\Temp\zndyx.exe"
    3⤵
    - Executes dropped EXE
    PID:4124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 184
      4⤵
      Program crash
      PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 4124 -ip 4124
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\eiizemzwv.urm

Filesize
48KB

MD5
97d43644cc9af705acc1a683cadd0532

SHA1
6b294e7fc7512a45a3ceef98f3d8810e31eaae46

SHA256
79684a35895eedf77a64ced8bcd7c9805d9a547359868b7746a6483cfe048dd8

SHA512
febb86f2b8635b5541946361aeede0a1c33a81fda7a92868bbd3e1a522948cb8b949b08c6472cc3627f02dbb5ade5aefb15e3001c01ada83e97647b1476bf4fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\fiprqyyl.ax

Filesize
206KB

MD5
6e55088fb6ebda76837bfc28643b79aa

SHA1
ea1427660d261e8e7e12f2587f4baee828373b65

SHA256
689fe7b36e167f2ee91c072fccc389387debfb1732c58f532441db4386df4cbc

SHA512
cc9dce29de0923dfeb99fb9e45e13eaa21bd56ae191fdebd98fb971543471fda058b72695f5efcf72eaab1acbcb59a7f876b550d2e4b594f391d0de856e86d67

Download Submit
C:\Users\Admin\AppData\Local\Temp\hxroji.au3

Filesize
4KB

MD5
b656f6a47a8ef58ab6a6f273f835bbc4

SHA1
5667db4f0945a12f66185fde08bbcad2378af5ee

SHA256
db24c3fcb1d4d4a9ee455c68a03220ee6c8afa243bb2f7030ce1b211cc8d9800

SHA512
a5506921a50e800ed966f313b5530b2473300ee8b6a003f5eac76f5ba83cac0670f9d0cbdef503a0a30d86c0cc35429a5a615baa055b3972dc18fb4cc870f3a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zndyx.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zndyx.exe

Filesize
872KB

MD5
c56b5f0201a3b3de53e561fe76912bfd

SHA1
2a4062e10a5de813f5688221dbeb3f3ff33eb417

SHA256
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

SHA512
195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

Download Submit
memory/4124-143-0x0000000000880000-0x00000000008AF000-memory.dmp

Filesize
188KB

Download