hxxps://wearedevs[.]net/d/Zorara

Analysis

max time kernel
1680s
max time network
1685s
platform
windows11-21h2_x64
resource
win11-20241007-de
resource tags

arch:x64arch:x86image:win11-20241007-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
17/10/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://wearedevs.net/d/Zorara

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
4716	msedge.exe
4716	msedge.exe
4532	msedge.exe
4532	msedge.exe
4000	identity_helper.exe
4000	identity_helper.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe
4032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 4832	4716	msedge.exe	80
PID 4716 wrote to memory of 4832	4716	msedge.exe	80
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 1920	4716	msedge.exe	82
PID 4716 wrote to memory of 3524	4716	msedge.exe	83
PID 4716 wrote to memory of 3524	4716	msedge.exe	83
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84
PID 4716 wrote to memory of 1664	4716	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://wearedevs.net/d/Zorara
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa360e3cb8,0x7ffa360e3cc8,0x7ffa360e3cd8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1732,3383664413081585158,15588808970042381542,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fdee96b970080ef7f5bfa5964075575e

SHA1
2c821998dc2674d291bfa83a4df46814f0c29ab4

SHA256
a241023f360b300e56b2b0e1205b651e1244b222e1f55245ca2d06d3162a62f0

SHA512
20875c3002323f5a9b1b71917d6bd4e4c718c9ca325c90335bd475ddcb25eac94cb3f29795fa6476d6d6e757622b8b0577f008eec2c739c2eec71d2e8b372cff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46e6ad711a84b5dc7b30b75297d64875

SHA1
8ca343bfab1e2c04e67b9b16b8e06ba463b4f485

SHA256
77b51492a40a511e57e7a7ecf76715a2fd46533c0f0d0d5a758f0224e201c77f

SHA512
8472710b638b0aeee4678f41ed2dff72b39b929b2802716c0c9f96db24c63096b94c9969575e4698f16e412f82668b5c9b5cb747e8a2219429dbb476a31d297e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
51ef46c36f5fb5fa5dfb894449e05b43

SHA1
a917d1dae66ccecdf4097967c71c88077db57fbb

SHA256
cc119df4aea894287f94d1294842604d008ac105a29251ed756964e633b2942d

SHA512
8fb0db251c8b6d8159b00576b5ef4ddf57d0489b75f820ac0636c20cd11d9d4a5c39709de84aee8ce5233cc317df3f117bb775c4cdfd3ae41c29a43bc9df2ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ce3313cbbfebc15f9fb6b4ebcfbfcf9f

SHA1
8e68a1ee3f0d886c6bed4cbcac98a47e94689320

SHA256
c8fb0a112b967a5e8000adcc9743ae6ed31de2f18b32067433970f9e4437b0c8

SHA512
38bdb71a75b8a5140c788c0ab0a435b9f8be19a410a7c764f4f22928c35c9c797e867b8ae39851d055d2be6e6d6e8b37b29bc74c0d9f6012fa469bba9a5ae551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ee7c06f23960c8055af5e7c83e47feaa

SHA1
1c94f40fb1b1169fca5395d0d92e930cc80acde8

SHA256
ddcfcac4bb8d924a4b98d7a7004876bf06e8a6af57c1c91c7a514f48854c3767

SHA512
c45c2de56e24e60e35aaec967a906d6deca3762e3dbd4b5cc6fec40ad975558663b5a8cfa951010df192408cb5a1a8a98e2ec7b26a3d89b9aa325d5be43162c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2994069c6b897d1b1038665fccef58df

SHA1
b974b062f590075d68fb76e57b46653b2afa9f0c

SHA256
44634c0ae39960a838b63a3758328c7c166f8d35f1c691ce0807eff5c1f323e6

SHA512
8ce8c9e99f5e10e9be679918833e939e8ae563171e685e0018709d942fb811fbd0338f8ee80e121b0fa4f4cb962d161bab490ecd552e51204ac28ab1039ab0b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0c2c20ec8d547006836479cde846ecc3

SHA1
ee53a4c6540d3cf79185ee116d9723caa081fee5

SHA256
ebbf52d93fb12e55f1880f1237d051a5879e3140209a68ba898d9a30e9c2ef90

SHA512
0adeb374459fc5029804c5532e80be99a7c173b50a5545436563dba7a28b5995bdf8d725a0628b3d1a03ac84e1422b06e14cac37f30d4fa1e2589092928af94b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58073e.TMP

Filesize
48B

MD5
167702d35273ee464da958e0bed51a21

SHA1
2ec10571bc349c32da1d79077265273268d91234

SHA256
74b8ebfbe882bbdc73f23be42c59a63b49bf65e32517747a95249544930574cb

SHA512
8a4018abc23e9e5b8093d608cfc28c88d52631a0490c52b2b229af5a1839aa665e5a8a8fffdf543f5d2891bf97759574f6dc30f73c7b2d52478f64aeb5f2d1fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
72b230f42d46a8941cc7a2ca691dca0d

SHA1
28d5fa4bb0bf8139569452dd7c3d0c26f8a27f76

SHA256
eacb6ead41157b379d4582b723f2f22700b17b0f57ed23e5c8876b1dd04021f5

SHA512
d86469c417d6efaedef4600572d6d8b477fb6e3fa1ba166c0e20567307babf00ec4edcf9fa266a459d295a23d6bda27381c64214f7f6a600d92d44f4d21e4fb3

Download Submit