2f7c6195415c8d32bbf266557f2e31b945204713487644c46328160d1e730337

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/12/2023, 01:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zztop.exe
Size

642KB
MD5

72049be7bd30ea61297ea624ae198067
SHA1

b7b74712a1d44aa3646eca78285e1e70c7c73083
SHA256

a21a16b0d9bfad52eced7a74d50c2acdfa42654d0fea2049312adf92542c4cad
SHA512

eb8f78b8e49c6df03409090b6c8bffe1a8a581baefad2b91855906bed284c52dfd74ae2fabde6eca52de8d89437c9ffdddeaf1a8cb000f5ea0ee699e9f14920a
SSDEEP

6144:qJXmzzSHV/y1FNI8taGqHTU/Kt6flq66O8PtYivxLGD4qI1Yhjb2OZEX93/opbos:0mzrZIiagKUtq6vQlX8

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2444	svchost.exe
2444	svchost.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2444	2096	zztop.exe	28
PID 2096 wrote to memory of 2444	2096	zztop.exe	28
PID 2096 wrote to memory of 2444	2096	zztop.exe	28
PID 2096 wrote to memory of 2444	2096	zztop.exe	28
PID 2096 wrote to memory of 2444	2096	zztop.exe	28
PID 2096 wrote to memory of 2444	2096	zztop.exe	28
PID 2096 wrote to memory of 2444	2096	zztop.exe	28
PID 2096 wrote to memory of 2444	2096	zztop.exe	28
PID 2096 wrote to memory of 2444	2096	zztop.exe	28
PID 2444 wrote to memory of 1256	2444	svchost.exe	12
PID 2444 wrote to memory of 1256	2444	svchost.exe	12
PID 2444 wrote to memory of 1256	2444	svchost.exe	12
PID 2444 wrote to memory of 1256	2444	svchost.exe	12
PID 2444 wrote to memory of 1256	2444	svchost.exe	12
PID 2444 wrote to memory of 1328	2444	svchost.exe	11
PID 2444 wrote to memory of 1328	2444	svchost.exe	11
PID 2444 wrote to memory of 1328	2444	svchost.exe	11
PID 2444 wrote to memory of 1328	2444	svchost.exe	11
PID 2444 wrote to memory of 1328	2444	svchost.exe	11

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1328
- C:\Users\Admin\AppData\Local\Temp\zztop.exe
  "C:\Users\Admin\AppData\Local\Temp\zztop.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\svchost.exe
    svchost.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2444

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-28-0x0000000001B10000-0x0000000001B1A000-memory.dmp

Filesize
40KB

Download
memory/1256-27-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/1256-29-0x0000000001B10000-0x0000000001B1A000-memory.dmp

Filesize
40KB

Download
memory/1256-26-0x0000000001AE0000-0x0000000001B01000-memory.dmp

Filesize
132KB

Download
memory/1256-35-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/1328-46-0x00000000021E0000-0x00000000021E2000-memory.dmp

Filesize
8KB

Download
memory/1328-40-0x0000000002A10000-0x0000000002A1A000-memory.dmp

Filesize
40KB

Download
memory/2096-2-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2096-15-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2096-4-0x0000000077190000-0x0000000077191000-memory.dmp

Filesize
4KB

Download
memory/2096-0-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2096-3-0x0000000077190000-0x0000000077191000-memory.dmp

Filesize
4KB

Download
memory/2096-1-0x0000000000020000-0x0000000000021000-memory.dmp

Filesize
4KB

Download
memory/2444-5-0x00000000000F0000-0x0000000000116000-memory.dmp

Filesize
152KB

Download
memory/2444-19-0x00000000000F0000-0x0000000000116000-memory.dmp

Filesize
152KB

Download
memory/2444-18-0x00000000000F0000-0x0000000000116000-memory.dmp

Filesize
152KB

Download
memory/2444-17-0x00000000000F0000-0x0000000000116000-memory.dmp

Filesize
152KB

Download