Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/06/2024, 03:39

General

  • Target

    ZenStudio.exe

  • Size

    19.6MB

  • MD5

    1fae469528fcc28ec48eb939b39f8a69

  • SHA1

    21f3642dbc8a5b7bd60cd285490f119aacdaa1a8

  • SHA256

    49e2e48406ae2b43df1e04c20c2fd13b9b25d7d16eb07bfe268f471ee755208c

  • SHA512

    16eb03db6c71770be6b142949f1eaee6ffd5839543d781b8870455cde089db643538c3ed12c2e03da43ec1e4a71ed0454343e23915a2ead9dcb0ff09432f17c1

  • SSDEEP

    393216:vM13RE6vuMqY6WIm9FzFfKTIX8g2JnniEMbvJBvoFzENUZM2Ez05Ts:vM13BmS7FYniEGRliNFE8s

Score
1/10

Malware Config

Signatures

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ZenStudio.exe
    "C:\Users\Admin\AppData\Local\Temp\ZenStudio.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2776

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          342B

          MD5

          2fa448c60a1268fa36811af84c403199

          SHA1

          9c4b4fd4465421ed20923180e1b6c6cebd39e79b

          SHA256

          1d35539079f828c472ce5531f3dd10c606eb374607b4e8a84ba47535a9a53396

          SHA512

          3631876ada3841a8bfd0d59bcfa150ecfb8ae6695c74165fe2951686fb07b90936ca9ee158741f492e6452acf4b719cf468187da62b97b4ce98b7d2500c0520a

        • C:\Users\Admin\AppData\Local\Temp\TarCB80.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        • memory/2776-18-0x0000000006150000-0x000000000615A000-memory.dmp

          Filesize

          40KB

        • memory/2776-19-0x0000000074A30000-0x000000007511E000-memory.dmp

          Filesize

          6.9MB

        • memory/2776-5-0x0000000000AE0000-0x0000000000AFC000-memory.dmp

          Filesize

          112KB

        • memory/2776-6-0x0000000005AD0000-0x0000000005AFA000-memory.dmp

          Filesize

          168KB

        • memory/2776-12-0x0000000005EC0000-0x0000000005ECE000-memory.dmp

          Filesize

          56KB

        • memory/2776-15-0x0000000006410000-0x0000000006442000-memory.dmp

          Filesize

          200KB

        • memory/2776-16-0x00000000062F0000-0x0000000006300000-memory.dmp

          Filesize

          64KB

        • memory/2776-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

          Filesize

          4KB

        • memory/2776-17-0x0000000006150000-0x000000000615A000-memory.dmp

          Filesize

          40KB

        • memory/2776-4-0x000000000F120000-0x000000000F232000-memory.dmp

          Filesize

          1.1MB

        • memory/2776-20-0x0000000009180000-0x00000000094E0000-memory.dmp

          Filesize

          3.4MB

        • memory/2776-21-0x00000000094E0000-0x00000000097DE000-memory.dmp

          Filesize

          3.0MB

        • memory/2776-22-0x00000000073E0000-0x0000000007456000-memory.dmp

          Filesize

          472KB

        • memory/2776-3-0x000000000DE10000-0x000000000EFA8000-memory.dmp

          Filesize

          17.6MB

        • memory/2776-2-0x0000000074A30000-0x000000007511E000-memory.dmp

          Filesize

          6.9MB

        • memory/2776-1-0x0000000000C10000-0x0000000001FA6000-memory.dmp

          Filesize

          19.6MB

        • memory/2776-129-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

          Filesize

          4KB

        • memory/2776-130-0x0000000074A30000-0x000000007511E000-memory.dmp

          Filesize

          6.9MB

        • memory/2776-131-0x0000000006150000-0x000000000615A000-memory.dmp

          Filesize

          40KB

        • memory/2776-132-0x0000000074A30000-0x000000007511E000-memory.dmp

          Filesize

          6.9MB