bb17080439f3a7b737a7cc2d77572bcc20613e09cf06ef3b54afa0fd2ad83a6f

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 10:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

45cf2fc9252af8600c0e4438f14e2383.exe
Size

113KB
MD5

45cf2fc9252af8600c0e4438f14e2383
SHA1

fb8ee847faa2dd1cca1e86bd188cdb0fcf64d63f
SHA256

bb17080439f3a7b737a7cc2d77572bcc20613e09cf06ef3b54afa0fd2ad83a6f
SHA512

b961e5d211b9143e33608d5d8d7026a31c05ad9c890c084c27475f303689d55512082b751aac6376f8e153d9294015bf9c65103eeb0f64cfb8114c4efacd8479
SSDEEP

3072:p3aVuNflJlwkX9kX1iJkXAkXAkXAkXtkX8kXQkXhkXIkX/kXdkX+kXmkXJkXMkXk:p3aVZkX9kX1iJkXAkXAkXAkXtkX8kXQ

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zpbiag.exe

Executes dropped EXE 1 IoCs

pid	Process
2660	zpbiag.exe

Loads dropped DLL 2 IoCs

pid	Process
2340	45cf2fc9252af8600c0e4438f14e2383.exe
2340	45cf2fc9252af8600c0e4438f14e2383.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\zpbiag = "C:\\Users\\Admin\\zpbiag.exe"	zpbiag.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe
2660	zpbiag.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2340	45cf2fc9252af8600c0e4438f14e2383.exe
2660	zpbiag.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2660	2340	45cf2fc9252af8600c0e4438f14e2383.exe	28
PID 2340 wrote to memory of 2660	2340	45cf2fc9252af8600c0e4438f14e2383.exe	28
PID 2340 wrote to memory of 2660	2340	45cf2fc9252af8600c0e4438f14e2383.exe	28
PID 2340 wrote to memory of 2660	2340	45cf2fc9252af8600c0e4438f14e2383.exe	28
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27
PID 2660 wrote to memory of 2340	2660	zpbiag.exe	27

C:\Users\Admin\AppData\Local\Temp\45cf2fc9252af8600c0e4438f14e2383.exe
"C:\Users\Admin\AppData\Local\Temp\45cf2fc9252af8600c0e4438f14e2383.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\zpbiag.exe
  "C:\Users\Admin\zpbiag.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\zpbiag.exe

Filesize
113KB

MD5
cdf0b1d6124b8cf26ae11e96a4180d2e

SHA1
86c866928fa4fe427a380102c7d13ab4c5f19b05

SHA256
14101934a760435ee27374bc0dacc8c123d211493d6b6d5ef414fa2f5b5b282b

SHA512
9c6a1d3dd9ee0880197014853056fd8d5955f9332e7e616e1e7edf574e90033ce9b84b5a79b886e47f14e287a545da15dc3cb4334ccf2d2db54a51dc9aa5cdc5

Download Submit