Overview
overview
7Static
static
3meowrara2.6.zip
windows11-21h2-x64
1ZoraraUI.e..._1.zip
windows11-21h2-x64
1ZoraraUI.e..._1.zip
windows11-21h2-x64
1ZoraraUI.e..._1.zip
windows11-21h2-x64
1ZoraraUI.e..._1.zip
windows11-21h2-x64
1ZoraraUI.e..._1.zip
windows11-21h2-x64
1ZoraraUI.e...s.json
windows11-21h2-x64
3ZoraraUI.e...as.hyb
windows11-21h2-x64
3ZoraraUI.e...be.hyb
windows11-21h2-x64
3ZoraraUI.e...bg.hyb
windows11-21h2-x64
3ZoraraUI.e...bn.hyb
windows11-21h2-x64
7ZoraraUI.e...cu.hyb
windows11-21h2-x64
3ZoraraUI.e...cy.hyb
windows11-21h2-x64
3ZoraraUI.e...da.hyb
windows11-21h2-x64
3ZoraraUI.e...01.hyb
windows11-21h2-x64
3ZoraraUI.e...96.hyb
windows11-21h2-x64
3ZoraraUI.e...01.hyb
windows11-21h2-x64
3ZoraraUI.e...gb.hyb
windows11-21h2-x64
3ZoraraUI.e...us.hyb
windows11-21h2-x64
3ZoraraUI.e...es.hyb
windows11-21h2-x64
3ZoraraUI.e...et.hyb
windows11-21h2-x64
3ZoraraUI.e...eu.hyb
windows11-21h2-x64
3ZoraraUI.e...fr.hyb
windows11-21h2-x64
3ZoraraUI.e...ga.hyb
windows11-21h2-x64
3ZoraraUI.e...gu.hyb
windows11-21h2-x64
3ZoraraUI.e...hi.hyb
windows11-21h2-x64
3ZoraraUI.e...hr.hyb
windows11-21h2-x64
3ZoraraUI.e...hu.hyb
windows11-21h2-x64
3ZoraraUI.e...hy.hyb
windows11-21h2-x64
3ZoraraUI.e...kn.hyb
windows11-21h2-x64
3xxhash.dll
windows11-21h2-x64
1zstd.dll
windows11-21h2-x64
1Analysis
-
max time kernel
210s -
max time network
276s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-09-2024 05:46
Static task
static1
Behavioral task
behavioral1
Sample
meowrara2.6.zip
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
ZoraraUI.exe.WebView2/EBWebView/component_crx_cache/kpfehajjjbbcifeehjgfgnabifknmdad_1.zip
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
ZoraraUI.exe.WebView2/EBWebView/component_crx_cache/ndikpojcjlepofdkaaldkinkjbeeebkl_1.zip
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
ZoraraUI.exe.WebView2/EBWebView/component_crx_cache/oankkpibpaokgecfckkdkgaoafllipag_1.zip
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
ZoraraUI.exe.WebView2/EBWebView/component_crx_cache/ohckeflnhegojcjlcpbfpciadgikcohk_1.zip
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
ZoraraUI.exe.WebView2/EBWebView/component_crx_cache/ojblfafjmiikbkepnnolpgbbhejhlcim_1.zip
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/_metadata/verified_contents.json
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-as.hyb
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-be.hyb
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-bg.hyb
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-bn.hyb
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-cu.hyb
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-cy.hyb
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-da.hyb
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-de-1901.hyb
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-de-1996.hyb
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-de-ch-1901.hyb
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-en-gb.hyb
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-en-us.hyb
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-es.hyb
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-et.hyb
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-eu.hyb
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-fr.hyb
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-ga.hyb
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-gu.hyb
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hi.hyb
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hr.hyb
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hu.hyb
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hy.hyb
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-kn.hyb
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
xxhash.dll
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
zstd.dll
Resource
win11-20240802-en
General
-
Target
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-en-gb.hyb
-
Size
45KB
-
MD5
fa3dcb77293a058277cb148a0ff491fa
-
SHA1
3335315b13cd82075da2adbebe32759c01833e8d
-
SHA256
ae4b78009d18e849d87458677151ee3aad1608ad72ec050dfd2421d22e7d031f
-
SHA512
c83a8c4eb29c3171fefe983c3e342b6af1bc1add7288c75c5a782dc14f12d2af83043c2b43c9ab3e5db61c91de6d7cb473746517debcff7ac2c0f05bb8b0971c
-
SSDEEP
768:8CPGXSlQXvRVYVL0xpPuB5YBBaEiQD6m8eft0Sr+uh0d3TPwHh8fJVVoxUb:8bXQMZQ0xwB5Y7aEiQD6mPf2S6uoTPwg
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 500 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\hyphen-data\101.0.4906.0\hyph-en-gb.hyb1⤵
- Modifies registry class
PID:4220
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:500