1e60513b4ee71a15d21c32ca13e163733eaff9a7dadf2eb989320548a4c13b78

Analysis

max time kernel
147s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZoraraUI.exe.WebView2/EBWebView/Default/Cache/Cache_Data/f_000001.gz
Size

170KB
MD5

d9d5de59488c160ec82077a175384aff
SHA1

0d3b0b2ad7636793e06406682dba49fc043000b7
SHA256

d50aeef84ae7e3685863249d28f6322e952792940fc5c851d921c9836332dab9
SHA512

daa64356473dc7143a864aa77895fd7258d61a5e4b6316fa4b4a258b18e20ef3805feed596fffd73dd7eb7e23522f097b5ba68ff705928c761aa20c38c08f3f2
SSDEEP

3072:TAdbCxeQJhYeIh+NXmqdFa+rzFu/UBILrcTypuQpBMBpB6AclI6Wy826:TA5CrYt8xmOFzAU8puQpBM1GUj

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 25 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2668	1560	cmd.exe	30
PID 1560 wrote to memory of 2668	1560	cmd.exe	30
PID 1560 wrote to memory of 2668	1560	cmd.exe	30
PID 2668 wrote to memory of 2804	2668	rundll32.exe	31
PID 2668 wrote to memory of 2804	2668	rundll32.exe	31
PID 2668 wrote to memory of 2804	2668	rundll32.exe	31
PID 2804 wrote to memory of 2796	2804	rundll32.exe	32
PID 2804 wrote to memory of 2796	2804	rundll32.exe	32
PID 2804 wrote to memory of 2796	2804	rundll32.exe	32
PID 2796 wrote to memory of 2704	2796	rundll32.exe	33
PID 2796 wrote to memory of 2704	2796	rundll32.exe	33
PID 2796 wrote to memory of 2704	2796	rundll32.exe	33
PID 2704 wrote to memory of 2584	2704	rundll32.exe	34
PID 2704 wrote to memory of 2584	2704	rundll32.exe	34
PID 2704 wrote to memory of 2584	2704	rundll32.exe	34
PID 2584 wrote to memory of 3052	2584	rundll32.exe	35
PID 2584 wrote to memory of 3052	2584	rundll32.exe	35
PID 2584 wrote to memory of 3052	2584	rundll32.exe	35
PID 3052 wrote to memory of 3056	3052	rundll32.exe	36
PID 3052 wrote to memory of 3056	3052	rundll32.exe	36
PID 3052 wrote to memory of 3056	3052	rundll32.exe	36
PID 3056 wrote to memory of 2324	3056	rundll32.exe	37
PID 3056 wrote to memory of 2324	3056	rundll32.exe	37
PID 3056 wrote to memory of 2324	3056	rundll32.exe	37
PID 2324 wrote to memory of 956	2324	rundll32.exe	38
PID 2324 wrote to memory of 956	2324	rundll32.exe	38
PID 2324 wrote to memory of 956	2324	rundll32.exe	38
PID 956 wrote to memory of 1788	956	rundll32.exe	39
PID 956 wrote to memory of 1788	956	rundll32.exe	39
PID 956 wrote to memory of 1788	956	rundll32.exe	39
PID 1788 wrote to memory of 1504	1788	rundll32.exe	40
PID 1788 wrote to memory of 1504	1788	rundll32.exe	40
PID 1788 wrote to memory of 1504	1788	rundll32.exe	40
PID 1504 wrote to memory of 2840	1504	rundll32.exe	41
PID 1504 wrote to memory of 2840	1504	rundll32.exe	41
PID 1504 wrote to memory of 2840	1504	rundll32.exe	41
PID 2840 wrote to memory of 1056	2840	rundll32.exe	42
PID 2840 wrote to memory of 1056	2840	rundll32.exe	42
PID 2840 wrote to memory of 1056	2840	rundll32.exe	42
PID 1056 wrote to memory of 2968	1056	rundll32.exe	43
PID 1056 wrote to memory of 2968	1056	rundll32.exe	43
PID 1056 wrote to memory of 2968	1056	rundll32.exe	43
PID 2968 wrote to memory of 2176	2968	rundll32.exe	44
PID 2968 wrote to memory of 2176	2968	rundll32.exe	44
PID 2968 wrote to memory of 2176	2968	rundll32.exe	44
PID 2176 wrote to memory of 2128	2176	rundll32.exe	45
PID 2176 wrote to memory of 2128	2176	rundll32.exe	45
PID 2176 wrote to memory of 2128	2176	rundll32.exe	45
PID 2128 wrote to memory of 2424	2128	rundll32.exe	46
PID 2128 wrote to memory of 2424	2128	rundll32.exe	46
PID 2128 wrote to memory of 2424	2128	rundll32.exe	46
PID 2424 wrote to memory of 928	2424	rundll32.exe	47
PID 2424 wrote to memory of 928	2424	rundll32.exe	47
PID 2424 wrote to memory of 928	2424	rundll32.exe	47
PID 928 wrote to memory of 1604	928	rundll32.exe	48
PID 928 wrote to memory of 1604	928	rundll32.exe	48
PID 928 wrote to memory of 1604	928	rundll32.exe	48
PID 1604 wrote to memory of 2464	1604	rundll32.exe	49
PID 1604 wrote to memory of 2464	1604	rundll32.exe	49
PID 1604 wrote to memory of 2464	1604	rundll32.exe	49
PID 2464 wrote to memory of 2488	2464	rundll32.exe	50
PID 2464 wrote to memory of 2488	2464	rundll32.exe	50
PID 2464 wrote to memory of 2488	2464	rundll32.exe	50
PID 2488 wrote to memory of 2368	2488	rundll32.exe	51

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
      4⤵
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2796
    - - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        5⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2704
      - C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        6⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2584
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        7⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        8⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        9⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        10⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        11⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1788
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        12⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        13⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2840
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        14⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        15⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2968
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        16⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        17⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2128
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        18⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        19⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        20⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        21⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        22⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2488
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        23⤵
        Modifies registry class
        
        PID:2368
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        24⤵
        Modifies registry class
        
        PID:1536
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        25⤵
        Modifies registry class
        
        PID:2216
        
        C:\Windows\system32\rundll32.exe
        
        "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZoraraUI.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000001.gz
        26⤵
        Modifies registry class
        
        PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads