Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/06/2024, 03:39

General

  • Target

    ZenStudio.exe

  • Size

    19.6MB

  • MD5

    1fae469528fcc28ec48eb939b39f8a69

  • SHA1

    21f3642dbc8a5b7bd60cd285490f119aacdaa1a8

  • SHA256

    49e2e48406ae2b43df1e04c20c2fd13b9b25d7d16eb07bfe268f471ee755208c

  • SHA512

    16eb03db6c71770be6b142949f1eaee6ffd5839543d781b8870455cde089db643538c3ed12c2e03da43ec1e4a71ed0454343e23915a2ead9dcb0ff09432f17c1

  • SSDEEP

    393216:vM13RE6vuMqY6WIm9FzFfKTIX8g2JnniEMbvJBvoFzENUZM2Ez05Ts:vM13BmS7FYniEGRliNFE8s

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ZenStudio.exe
    "C:\Users\Admin\AppData\Local\Temp\ZenStudio.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2776

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2fa448c60a1268fa36811af84c403199

    SHA1

    9c4b4fd4465421ed20923180e1b6c6cebd39e79b

    SHA256

    1d35539079f828c472ce5531f3dd10c606eb374607b4e8a84ba47535a9a53396

    SHA512

    3631876ada3841a8bfd0d59bcfa150ecfb8ae6695c74165fe2951686fb07b90936ca9ee158741f492e6452acf4b719cf468187da62b97b4ce98b7d2500c0520a

  • C:\Users\Admin\AppData\Local\Temp\TarCB80.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2776-18-0x0000000006150000-0x000000000615A000-memory.dmp

    Filesize

    40KB

  • memory/2776-19-0x0000000074A30000-0x000000007511E000-memory.dmp

    Filesize

    6.9MB

  • memory/2776-5-0x0000000000AE0000-0x0000000000AFC000-memory.dmp

    Filesize

    112KB

  • memory/2776-6-0x0000000005AD0000-0x0000000005AFA000-memory.dmp

    Filesize

    168KB

  • memory/2776-12-0x0000000005EC0000-0x0000000005ECE000-memory.dmp

    Filesize

    56KB

  • memory/2776-15-0x0000000006410000-0x0000000006442000-memory.dmp

    Filesize

    200KB

  • memory/2776-16-0x00000000062F0000-0x0000000006300000-memory.dmp

    Filesize

    64KB

  • memory/2776-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

    Filesize

    4KB

  • memory/2776-17-0x0000000006150000-0x000000000615A000-memory.dmp

    Filesize

    40KB

  • memory/2776-4-0x000000000F120000-0x000000000F232000-memory.dmp

    Filesize

    1.1MB

  • memory/2776-20-0x0000000009180000-0x00000000094E0000-memory.dmp

    Filesize

    3.4MB

  • memory/2776-21-0x00000000094E0000-0x00000000097DE000-memory.dmp

    Filesize

    3.0MB

  • memory/2776-22-0x00000000073E0000-0x0000000007456000-memory.dmp

    Filesize

    472KB

  • memory/2776-3-0x000000000DE10000-0x000000000EFA8000-memory.dmp

    Filesize

    17.6MB

  • memory/2776-2-0x0000000074A30000-0x000000007511E000-memory.dmp

    Filesize

    6.9MB

  • memory/2776-1-0x0000000000C10000-0x0000000001FA6000-memory.dmp

    Filesize

    19.6MB

  • memory/2776-129-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

    Filesize

    4KB

  • memory/2776-130-0x0000000074A30000-0x000000007511E000-memory.dmp

    Filesize

    6.9MB

  • memory/2776-131-0x0000000006150000-0x000000000615A000-memory.dmp

    Filesize

    40KB

  • memory/2776-132-0x0000000074A30000-0x000000007511E000-memory.dmp

    Filesize

    6.9MB