Analysis
-
max time kernel
30s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
11/09/2024, 19:28
General
-
Target
Setup ZENOLOGY v2.0.1.exe
-
Size
251.9MB
-
MD5
276f290cc5efe23f442cdcdfe8ca52d2
-
SHA1
20b30dd025f103ec5b429f82c1122f16ab01b1cc
-
SHA256
f7bead25fe07170ed748211b6ceb18cea28a9ee8246fb79f06e5975ac5fe8570
-
SHA512
8e4270047162f20fbbdf57311c7ce8e50289b5579ce66ccdcf36830da2092b1f96db96049c2a8b7a424526e55198924afc76b6dfbe9d13f99006a45ff186423a
-
SSDEEP
3145728:yBIc0JTsieZjUO1Qa5VKUJtphWEiloikWUGOVfP8Nz1bs8ErVmlRQJ3DFrhHZJd6:mPieMa5VK6pheloiRxOp8Nz1LGMYN5X6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup ZENOLOGY v2.0.1.exe"C:\Users\Admin\AppData\Local\Temp\Setup ZENOLOGY v2.0.1.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TAJ5D.tmp\Setup ZENOLOGY v2.0.1.tmp"C:\Users\Admin\AppData\Local\Temp\is-TAJ5D.tmp\Setup ZENOLOGY v2.0.1.tmp" /SL5="$70154,263740264,121344,C:\Users\Admin\AppData\Local\Temp\Setup ZENOLOGY v2.0.1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD59d09d1cbfc366063b27bbc6c188057b6
SHA155ee5c774853b83c2a08ce14a34a7d8655694921
SHA2562abbf4bd33f64ecd045d02e02feec035b9c23cc10133667b5c7c57e764d9557a
SHA5120afbcaaf839cd8c270677a5c29010ab2f956ec3885e2050e4051a4f44f57fb965843d1146725de955824c2df72921eaad8af6a3b67232c1a621de5fb97629e7e
-
Filesize
5KB
MD5cef6cc41de5cede9521ba6f1ca0be3e5
SHA10aeef649f2e0d0a883009a735aedb1117d1ccb23
SHA2561d12b8cecbcfb152261b9cf9027b456420a9bb64d8291aaa06b43c198fce657a
SHA5127be43e4f855d6b1afbf45c2ad25bef0b0660b40d719a0ea8709bbbdc046453f2b7ba759871e8cfbd9c7113bca8c0c7e0346efe768b3dbded54fa22f89a7f45ef
-
Filesize
2KB
MD538ee807c3cf9119b64ef9eafd10f4825
SHA1145609a36472c3460e249a34be528d686ba05197
SHA256eac0dfbdfe75195e352ed2f4d4f819e35ff34ac9d3c2122db80f7a442a9363d9
SHA5121362f7101a995b909fcc3b278a5728ffecbebdee7b038bfabcf5e81d4c138a46dc2ef83442c80df6050906671ef73ce64d29616c1a4ada1fa7255baae76720ee
-
Filesize
1.2MB
MD53ef1e677c92240c2c15132ac963f70b8
SHA15726c4cf6048347e6c161a3f09b3498a99a5ff0f
SHA2565a62717d8209b18e3e5b1e831c76d96f9cc6dfccf27f1e28d80eff6c26f70980
SHA5127e1267cd62a2fcaaf6aead59af29dc03ffea1ed7d50bcd0c28562de45d6b6eee8cfc8b1f805c37528a411cd6274f6c93c187fd7ef948a0e14e491026cd7c8e86
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD55df8ada84a16f5dfc24096ef90a5ce3a
SHA15e7e9c68119c3a0a1afc92c60674bc8714492823
SHA25648a9c8c332fde541b571d9d522d0e37834b452f55af8cbdc341b12222e78fb5b
SHA512661b5219c74dd6e3a8e899a1b1a3002689d148e337d7323a174519366c9548c284ee76e2faa2f9600cd483db21093ee62399f0d7403c39523c654266760191c2
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
160KB
-
Filesize
68KB
-
Filesize
216KB
-
Filesize
348KB
-
Filesize
348KB
-
Filesize
628KB
-
Filesize
1.1MB
-
Filesize
12.3MB
-
Filesize
640KB
-
Filesize
12.3MB
-
Filesize
92KB
-
Filesize
224KB
-
Filesize
524KB
-
Filesize
492KB
-
Filesize
348KB
-
Filesize
1.6MB
-
Filesize
572KB
-
Filesize
1.4MB
-
Filesize
36KB
-
Filesize
388KB
-
Filesize
980KB
-
Filesize
1.6MB
-
Filesize
200KB
-
Filesize
168KB
-
Filesize
560KB
-
Filesize
224KB
-
Filesize
388KB
-
Filesize
388KB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
980KB
-
Filesize
228KB
-
Filesize
200KB
-
Filesize
560KB
-
Filesize
524KB
-
Filesize
640KB
-
Filesize
1.6MB
-
Filesize
72KB
-
Filesize
36KB
-
Filesize
640KB
-
Filesize
156KB
-
Filesize
1.6MB
-
Filesize
980KB
-
Filesize
228KB
-
Filesize
200KB
-
Filesize
560KB
-
Filesize
524KB
-
Filesize
76KB
-
Filesize
492KB
-
Filesize
348KB
-
Filesize
1.6MB
-
Filesize
72KB
-
Filesize
628KB
-
Filesize
640KB
-
Filesize
572KB
-
Filesize
388KB
-
Filesize
216KB
-
Filesize
1.6MB
-
Filesize
980KB
-
Filesize
228KB
-
Filesize
200KB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
388KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB