e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0

General

Target

e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe
Size

184KB
MD5

2a9ec970f2c6e9b7ef9f3f982e994529
SHA1

4e23e9d2b8911cf88f6876aa677be571524ab0dd
SHA256

e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0
SHA512

64e5a176d081f81929de245ccbca0386eecb2a6faeb5f3b6f1e49c4341aec9deedd36efbc801d59af8f1f840dfce35be934aa8083802202ea7690483388e3aa0
SSDEEP

3072:1WiRMlXL6KvWeRl6Knvmb7/D26DKcAA6vQOm34lK5/si+yS3A:t2X5VREKnvmb7/D26DKcV67m34E5/skj

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exezinuj.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	zinuj.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe

Executes dropped EXE 1 IoCs

Processes:

zinuj.exe

pid process

4816 zinuj.exe

pid	process
4816	zinuj.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

zinuj.exee3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /Y"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /C"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /p"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /h"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /H"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /f"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /v"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /Q"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /U"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /M"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /b"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /G"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /R"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /y"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /d"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /D"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /t"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /j"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /c"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /x"	e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /Z"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /g"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /X"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /z"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /n"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /P"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /s"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /L"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /S"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /e"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /T"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /o"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /q"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /I"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /W"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /O"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /E"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /N"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /V"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /K"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /J"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /i"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /u"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /w"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /x"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /B"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /A"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /a"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /k"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /l"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /m"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /F"	zinuj.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zinuj = "C:\\Users\\Admin\\zinuj.exe /r"	zinuj.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exezinuj.exe

pid	process
4652	e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe
4652	e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe
4816	zinuj.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exezinuj.exe

pid process

4652 e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe
4816 zinuj.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe

description	pid	process	target process
PID 4652 wrote to memory of 4816	4652	e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe	zinuj.exe
PID 4652 wrote to memory of 4816	4652	e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe	zinuj.exe
PID 4652 wrote to memory of 4816	4652	e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe	zinuj.exe

C:\Users\Admin\AppData\Local\Temp\e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe
"C:\Users\Admin\AppData\Local\Temp\e3444374663bf90ac5b0ba44e31db3a4b56131ff949ba1aa9b57888644916ce0.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652

C:\Users\Admin\zinuj.exe
"C:\Users\Admin\zinuj.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4816

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\zinuj.exe
Filesize
184KB

MD5
65f597e92d2ae61541862df11281efed

SHA1
f7d79cce56143a15d9520efa2d02db3da01aa072

SHA256
570276a25b3fa0d7bdabb269c3f2f43c9f5850a9cfb9bc94e4ac047d6b9c1a77

SHA512
86d0c372540e28320919765f5170a9764848e088528166b2d8523def07441d9f6e5a1151f32faf9587bf5bb0ffbff348d1bd4b5d28192940785ca560a416bb10

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads