Overview

overview

10

Static

static

10

2024-01-02...in.exe

windows7-x64

10

2024-01-02...in.exe

windows10-1703-x64

10

2024-01-02...in.exe

windows10-2004-x64

10

2024-01-02...in.exe

windows11-21h2-x64

10

Resubmissions

03-01-2024 15:08

240103-shylyshgh6 10

03-01-2024 15:05

240103-sf7rvahgf3 10

03-01-2024 15:03

240103-sfclpsfdcq 10

Analysis

  • max time kernel
    24s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03-01-2024 15:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe

  • Size

    211KB

  • MD5

    bab201c1a2c8e0f99e683591945e7e3d

  • SHA1

    90e57172d463dcd6df22d2bf96a6b265a7fdec65

  • SHA256

    88b121f3b3e95e36a642cfdcb0c80f47e4b286e4dbf79b26c923909f4a4f11a4

  • SHA512

    d65bc6b40aa4843cf6a9889bcf47b42c8f5b5548c377bd57a32cb7e2cbe2851e5904c3e1631ec87005243b8e33ec371f599f60964e5c94c856943a1846cccc2a

  • SSDEEP

    6144:jia1gMHOPDWIhID8X/4DQFu/U3buRKlemZ9DnGAetTsB+zY+:jIMH06cID84DQFu/U3buRKlemZ9DnGAs

Score
10/10
zeppelinpersistenceransomware

Malware Config

Signatures

  • Detects Zeppelin payload 11 IoCs
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Renames multiple (2709) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -start
      2⤵
      • Executes dropped EXE
      PID:3272
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
          PID:4620
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
          3⤵
            PID:3328
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
            3⤵
              PID:4956
            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 1
              3⤵
                PID:5004
              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 0
                3⤵
                  PID:3740
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                  3⤵
                    PID:792
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
                    3⤵
                      PID:1320
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
                      3⤵
                        PID:3520
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
                        3⤵
                          PID:2024
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                          3⤵
                            PID:1080
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:32
                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                            wmic shadowcopy delete
                            3⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4884
                        • C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe
                          "C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe" -agent 1
                          2⤵
                            PID:4664
                          • C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe
                            "C:\Users\Admin\AppData\Local\Temp\2024-01-02_bab201c1a2c8e0f99e683591945e7e3d_zeppelin.exe" -agent 0
                            2⤵
                            • Drops file in Program Files directory
                            PID:848
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                            2⤵
                              PID:3580
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
                              2⤵
                                PID:1200
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
                                2⤵
                                  PID:2888
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
                                  2⤵
                                    PID:2896
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                                    2⤵
                                      PID:2656
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                                      2⤵
                                        PID:2620
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                                        2⤵
                                          PID:336
                                      • C:\Windows\system32\vssvc.exe
                                        C:\Windows\system32\vssvc.exe
                                        1⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:236
                                      • C:\Windows\System32\Conhost.exe
                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                        1⤵
                                          PID:2620
                                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                          wmic shadowcopy delete
                                          1⤵
                                            PID:5084

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • memory/848-13042-0x0000000000500000-0x0000000000640000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/848-22587-0x0000000000500000-0x0000000000640000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/3272-13-0x0000000000490000-0x00000000005D0000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/3272-18706-0x0000000000490000-0x00000000005D0000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/3272-22590-0x0000000000490000-0x00000000005D0000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/3740-22588-0x0000000000490000-0x00000000005D0000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/4664-14-0x0000000000500000-0x0000000000640000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/4680-12-0x0000000000500000-0x0000000000640000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/4680-8100-0x0000000000500000-0x0000000000640000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/4680-22589-0x0000000000500000-0x0000000000640000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download

                                          • memory/5004-14194-0x0000000000490000-0x00000000005D0000-memory.dmp

                                            Filesize

                                            1.2MB

                                            Download