6cc0ceb357ed946f6be3b9c8d0c2c4d53662708e17fbd0988b125208cc0d1d63

Analysis

max time kernel
1560s
max time network
1565s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/12/2023, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Zenith-Private-Expose-main/ZenithPriv.deps.json
Size

63KB
MD5

3b5d1a6f35eda5411dd029f78cbfd3ba
SHA1

78a14e80c89e7f584686f7d3850d124057b266cf
SHA256

4c4213abd74b6a81e945763012ce46d037c35ea19e038b5f78fb553685ec8be9
SHA512

5ea7c5851ba08f8f5c68f256b5310681909d1350ec28f81c7424f9033e9b2d8be496a78fe794b8d355f2ebb5ec7a829292b3b3d886bcee53bf1d54eb109deba5
SSDEEP

1536:6vDjTvb773lcu7znBARSiL1ONeljpZKStn3hR:6Xlcu7znBARSiL1ONeljpZKStxR

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2716	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2716	AcroRd32.exe
2716	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2772	2232	cmd.exe	29
PID 2232 wrote to memory of 2772	2232	cmd.exe	29
PID 2232 wrote to memory of 2772	2232	cmd.exe	29
PID 2772 wrote to memory of 2716	2772	rundll32.exe	30
PID 2772 wrote to memory of 2716	2772	rundll32.exe	30
PID 2772 wrote to memory of 2716	2772	rundll32.exe	30
PID 2772 wrote to memory of 2716	2772	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Zenith-Private-Expose-main\ZenithPriv.deps.json
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Zenith-Private-Expose-main\ZenithPriv.deps.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Zenith-Private-Expose-main\ZenithPriv.deps.json"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
207fc4643d5a1ee6e130b862a46d9ec2

SHA1
7b6a8a0e64650a0a507b2c1cb450e8e5797255d3

SHA256
83f7f3242d6cc5327ce28484fc55bc0eb69573a8f53b87f26ee8720d408eb4fa

SHA512
c56f1af792557a0931a2af8579b8017f3f924239a389fb68649697c7119b3a4be65e3cdd2a73a7f92496939a3f8d15dbb391e80f66d7c9e6aaf6efc8ba95e5e5

Download Submit