dffb606169831b2baea5de7c081ea21f11dfd70224ba90e3f39d4734981b02c6

Analysis

max time kernel
130s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zhongaclient by zhong 0.0.7 p75/main1.css
Size

115KB
MD5

68194f5ef60e18898f979aea8c51e77e
SHA1

f4ef53e3e65f1083781840c67ce7753f6347bae4
SHA256

393a3de3bbf299645795394feef5258fd3dfae36e2caac5d9257b2491803c460
SHA512

6785df06cc570ff8d3387511d49729daefc7eb4d96aecb82cc41e45cf6bfdd35ab44c3f34d7fafe8e913ae76b3f15ab5972bf00254bb26501d77af4adc7c0dfb
SSDEEP

3072:pMQg/ZUnePf/ujy3f4cePf/ujy3f4Z1g5xhZcdx2CJQVdpV4JVC6RghZhhEVpumN:pMQg/ZEePf/ujy3f4cePf/ujy3f4Z1gC

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4904	3556	cmd.exe	85
PID 3556 wrote to memory of 4904	3556	cmd.exe	85

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\zhongaclient by zhong 0.0.7 p75\main1.css"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\zhongaclient by zhong 0.0.7 p75\main1.css
  2⤵
  PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...