Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 03:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe
Resource
win7-20240508-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe
-
Size
311KB
-
MD5
44508d7d25e5a3d394ad7199cb35a6af
-
SHA1
65e5c84c4b3ceef9a27a1dc2358c1d2726b335c2
-
SHA256
d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c
-
SHA512
2d3f785980de8273dac3d66bd379a52b2dc9aeab358063be90db1cc3eacbaeaaf1a024ef108e0797a43b92ed6ffdf7a8f0a8af8315dafa1f90f471a155200e6b
-
SSDEEP
6144:uY7BO63UKCweQ7Ovc93dRBsIpJwK8aWlIeD4d2WYcSA2MuLH1bJp:D7mECN3A2T5X
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ziomim.exe -
Executes dropped EXE 1 IoCs
pid Process 2168 ziomim.exe -
Loads dropped DLL 2 IoCs
pid Process 3056 d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe 3056 d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /A" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /B" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /I" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /k" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /m" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /t" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /s" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /J" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /M" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /b" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /S" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /X" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /h" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /i" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /Z" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /r" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /G" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /g" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /x" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /D" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /R" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /T" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /U" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /a" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /z" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /e" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /w" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /W" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /f" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /H" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /N" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /K" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /q" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /O" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /Q" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /L" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /j" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /T" d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /p" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /c" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /y" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /Y" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /d" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /V" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /o" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /F" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /C" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /P" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /u" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /l" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /v" ziomim.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\ziomim = "C:\\Users\\Admin\\ziomim.exe /n" ziomim.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3056 d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe 2168 ziomim.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3056 d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe 2168 ziomim.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2168 3056 d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe 28 PID 3056 wrote to memory of 2168 3056 d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe 28 PID 3056 wrote to memory of 2168 3056 d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe 28 PID 3056 wrote to memory of 2168 3056 d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe"C:\Users\Admin\AppData\Local\Temp\d27f28076e97c63401e3397c8e2a7d945da13f2292da9a6c214b6a39dc432e6c.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\ziomim.exe"C:\Users\Admin\ziomim.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
311KB
MD5b3124e3933675546e12e0d484a04f510
SHA13f08623d66fe78849ebceb2097500d0d4f182b4f
SHA2561ede704c1763d12eb813c38c215cdf2c658fb44cee756e595e53047d1dfd8fbb
SHA5121cf1a217b95766677a8d9c5e14035826cc8f329636afb95552ab6ff4b03b8efbc9739e7a8f8226ba3711d3dd5a6f433e5c1b79cc171754cb7f2aa91713d358c4