Overview
overview
7Static
static
3meowrara2.6.zip
windows11-21h2-x64
1ZoraraUI.e..._1.zip
windows11-21h2-x64
1ZoraraUI.e..._1.zip
windows11-21h2-x64
1ZoraraUI.e..._1.zip
windows11-21h2-x64
1ZoraraUI.e..._1.zip
windows11-21h2-x64
1ZoraraUI.e..._1.zip
windows11-21h2-x64
1ZoraraUI.e...s.json
windows11-21h2-x64
3ZoraraUI.e...as.hyb
windows11-21h2-x64
3ZoraraUI.e...be.hyb
windows11-21h2-x64
3ZoraraUI.e...bg.hyb
windows11-21h2-x64
3ZoraraUI.e...bn.hyb
windows11-21h2-x64
7ZoraraUI.e...cu.hyb
windows11-21h2-x64
3ZoraraUI.e...cy.hyb
windows11-21h2-x64
3ZoraraUI.e...da.hyb
windows11-21h2-x64
3ZoraraUI.e...01.hyb
windows11-21h2-x64
3ZoraraUI.e...96.hyb
windows11-21h2-x64
3ZoraraUI.e...01.hyb
windows11-21h2-x64
3ZoraraUI.e...gb.hyb
windows11-21h2-x64
3ZoraraUI.e...us.hyb
windows11-21h2-x64
3ZoraraUI.e...es.hyb
windows11-21h2-x64
3ZoraraUI.e...et.hyb
windows11-21h2-x64
3ZoraraUI.e...eu.hyb
windows11-21h2-x64
3ZoraraUI.e...fr.hyb
windows11-21h2-x64
3ZoraraUI.e...ga.hyb
windows11-21h2-x64
3ZoraraUI.e...gu.hyb
windows11-21h2-x64
3ZoraraUI.e...hi.hyb
windows11-21h2-x64
3ZoraraUI.e...hr.hyb
windows11-21h2-x64
3ZoraraUI.e...hu.hyb
windows11-21h2-x64
3ZoraraUI.e...hy.hyb
windows11-21h2-x64
3ZoraraUI.e...kn.hyb
windows11-21h2-x64
3xxhash.dll
windows11-21h2-x64
1zstd.dll
windows11-21h2-x64
1Analysis
-
max time kernel
88s -
max time network
192s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
15-09-2024 05:46
Static task
static1
Behavioral task
behavioral1
Sample
meowrara2.6.zip
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
ZoraraUI.exe.WebView2/EBWebView/component_crx_cache/kpfehajjjbbcifeehjgfgnabifknmdad_1.zip
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
ZoraraUI.exe.WebView2/EBWebView/component_crx_cache/ndikpojcjlepofdkaaldkinkjbeeebkl_1.zip
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
ZoraraUI.exe.WebView2/EBWebView/component_crx_cache/oankkpibpaokgecfckkdkgaoafllipag_1.zip
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
ZoraraUI.exe.WebView2/EBWebView/component_crx_cache/ohckeflnhegojcjlcpbfpciadgikcohk_1.zip
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
ZoraraUI.exe.WebView2/EBWebView/component_crx_cache/ojblfafjmiikbkepnnolpgbbhejhlcim_1.zip
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/_metadata/verified_contents.json
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-as.hyb
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-be.hyb
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-bg.hyb
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-bn.hyb
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-cu.hyb
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-cy.hyb
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-da.hyb
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-de-1901.hyb
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-de-1996.hyb
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-de-ch-1901.hyb
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-en-gb.hyb
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-en-us.hyb
Resource
win11-20240802-en
Behavioral task
behavioral20
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-es.hyb
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-et.hyb
Resource
win11-20240802-en
Behavioral task
behavioral22
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-eu.hyb
Resource
win11-20240802-en
Behavioral task
behavioral23
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-fr.hyb
Resource
win11-20240802-en
Behavioral task
behavioral24
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-ga.hyb
Resource
win11-20240802-en
Behavioral task
behavioral25
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-gu.hyb
Resource
win11-20240802-en
Behavioral task
behavioral26
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hi.hyb
Resource
win11-20240802-en
Behavioral task
behavioral27
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hr.hyb
Resource
win11-20240802-en
Behavioral task
behavioral28
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hu.hyb
Resource
win11-20240802-en
Behavioral task
behavioral29
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hy.hyb
Resource
win11-20240802-en
Behavioral task
behavioral30
Sample
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-kn.hyb
Resource
win11-20240802-en
Behavioral task
behavioral31
Sample
xxhash.dll
Resource
win11-20240802-en
Behavioral task
behavioral32
Sample
zstd.dll
Resource
win11-20240802-en
General
-
Target
ZoraraUI.exe.WebView2/EBWebView/hyphen-data/101.0.4906.0/hyph-hu.hyb
-
Size
309KB
-
MD5
37b1f197e8dfbafdac4597edcf673e63
-
SHA1
e672c6870417c71acdcda6c16a7185d7a868eb68
-
SHA256
8b3a16268cc932b226c17ff405b3cfb6eb38a9511a2043d653dc03729efceac1
-
SHA512
69ee820439633b348bf8efdd3c498a30270753e53ff78d022bd1b295c6c95e0501955009f610a12fc55c786a563b0af40d2b69a7584b47662b943acbac2d3634
-
SSDEEP
6144:wxOMr0dBjIg2U0RT7c25PkvQoc6yzRcOmpTeIrDh2ky5khBh13kwTbqgT3Gfhh4D:wvkufNkzFtuWlAh36
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 1624 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\hyphen-data\101.0.4906.0\hyph-hu.hyb1⤵
- Modifies registry class
PID:3532
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1624