Analysis
- max time kernel
594s - max time network
456s - platform
windows11-21h2_x64 - resource
win11-20240419-en - resource tags
- submitted
03/05/2024, 17:51
General
- Target ZenStudio.exe
- Size 19.6MB
- Sample240503-wfdesafa77
- SHA256 49e2e48406ae2b43df1e04c20c2fd13b9b25d7d16eb07bfe268f471ee755208c
Malware Config
Signatures
- Modifies registry class 7 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ZenStudio.exe"C:\Users\Admin\AppData\Local\Temp\ZenStudio.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3980-0-0x00000000745DE000-0x00000000745DF000-memory.dmp
memory/3980-1-0x0000000000EE0000-0x0000000002276000-memory.dmp
memory/3980-2-0x00000000745D0000-0x0000000074D81000-memory.dmp
memory/3980-3-0x000000000E300000-0x000000000F498000-memory.dmp
memory/3980-4-0x0000000008540000-0x0000000008652000-memory.dmp
memory/3980-5-0x0000000006EB0000-0x0000000006F16000-memory.dmp
memory/3980-6-0x0000000008E20000-0x0000000008E76000-memory.dmp
memory/3980-8-0x0000000009760000-0x000000000978A000-memory.dmp
memory/3980-7-0x0000000009740000-0x000000000975C000-memory.dmp
memory/3980-14-0x0000000007280000-0x000000000728E000-memory.dmp
memory/3980-17-0x00000000075C0000-0x00000000075F2000-memory.dmp
memory/3980-18-0x00000000075F0000-0x0000000007600000-memory.dmp
memory/3980-19-0x00000000745D0000-0x0000000074D81000-memory.dmp
memory/3980-20-0x0000000007DB0000-0x0000000007DB8000-memory.dmp
memory/3980-21-0x0000000007E20000-0x0000000007E58000-memory.dmp
memory/3980-22-0x0000000007DF0000-0x0000000007DFE000-memory.dmp
memory/3980-23-0x000000000C8B0000-0x000000000CE56000-memory.dmp
memory/3980-24-0x0000000007F40000-0x0000000007FD2000-memory.dmp
memory/3980-25-0x00000000745D0000-0x0000000074D81000-memory.dmp
memory/3980-26-0x0000000009E40000-0x000000000A1A0000-memory.dmp
memory/3980-27-0x000000000C300000-0x000000000C5FE000-memory.dmp
memory/3980-28-0x0000000007FE0000-0x0000000007FE8000-memory.dmp
memory/3980-29-0x0000000008010000-0x0000000008086000-memory.dmp
memory/3980-30-0x000000000C840000-0x000000000C848000-memory.dmp
memory/3980-31-0x00000000745DE000-0x00000000745DF000-memory.dmp
memory/3980-32-0x00000000745D0000-0x0000000074D81000-memory.dmp
memory/3980-33-0x00000000745D0000-0x0000000074D81000-memory.dmp
memory/3980-34-0x00000000745D0000-0x0000000074D81000-memory.dmp