General

  • Target

    https://cdn.discordapp.com/attachments/850854604554895461/1271993054978379877/zion.exe?ex=66bf4a18&is=66bdf898&hm=399dd66c0c98123104ca84288e3e36c513bef7b532b7a884c0d5326d4f18804c&

  • Sample

    240815-2sj1zszcnh

Malware Config

Targets

    • Target

      https://cdn.discordapp.com/attachments/850854604554895461/1271993054978379877/zion.exe?ex=66bf4a18&is=66bdf898&hm=399dd66c0c98123104ca84288e3e36c513bef7b532b7a884c0d5326d4f18804c&

    • Modifies visibility of file extensions in Explorer

    • UAC bypass

    • Modifies boot configuration data using bcdedit

    • Disables taskbar notifications via registry modification

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

    • Possible privilege escalation attempt

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

    • Modifies system executable filetype association

    • Checks whether UAC is enabled

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Drops desktop.ini file(s)

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    • Hijack Execution Flow: Executable Installer File Permissions Weakness

      Possible Turn off User Account Control's privilege elevation for standard users.

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Legitimate hosting services abused for malware hosting/C2

    • Power Settings

      powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks