Analysis
-
max time kernel
46s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/10/2024, 22:51
General
-
Target
Zelo-Client.jar
-
Size
639KB
-
MD5
8bac893810be1acf6b083f16363a73cf
-
SHA1
d291c9dc85d7df6f1222d8bcaf5bb10e2578fa56
-
SHA256
739d2d19e79d073f9e1d1489c145879cff44c2c91e5d691d53ccc8599ac8a467
-
SHA512
e9dcb3dcd6924b61c67af33e88d59bc9d6b2e626234eb09aa18463e09622670d1d220024e9a504b44de23ca88bb426f295968e8d7dd644f49128c8ca7ed4d629
-
SSDEEP
12288:hTVSQY/o6EXir4XWAaZXgY/dR3+ZgGN29BgQViRqT3iuE2FQS/LDsj:hTIQUkXK4GTXgYHaF29+GXiuZFr/LDsj
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\Zelo-Client.jar1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729464741560.tmp2⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c "REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729464741560.tmp" /f"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Home /d "C:\Program Files\Java\jre-1.8\bin\javaw.exe -jar C:\Users\Admin\AppData\Roaming\Microsoft\.tmp\1729464741560.tmp" /f3⤵
- Adds Run key to start application
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5a50fa5346b106e29e14fed3133bed41b
SHA1ce1de2dd4a186ad0fa9f508edc86c292e5bbcda0
SHA25690773d04c76fde20f4ff179f7f033af9b631a99b015fb168ffdb70fefc456db2
SHA5127f18a467f54500544cadeb99e265fa729885b5f0dce508cfb3dba76a34e46eb92afae00e90a52379ec9192a84686059df6be9bc1c23a6c43c054a0f626dc94b2
-
Filesize
28KB
MD5eeebe1039cc5d4fe5daace4837ea3930
SHA1096104800f9bb6abc851aef75dc5cdc95d6cafcf
SHA25645ebef7bd80cfe8e872c7205b67ab2f27384f058566ba2ba39048836749f9ff0
SHA512c0256164cb51197f135981b6fda7ab6137e95eac754c9662b5dd7fa3847f26ebfca85c62d59fe2eff0da4289c1747addca0cecbafc0314955991976c2907a453
-
Filesize
639KB
MD58bac893810be1acf6b083f16363a73cf
SHA1d291c9dc85d7df6f1222d8bcaf5bb10e2578fa56
SHA256739d2d19e79d073f9e1d1489c145879cff44c2c91e5d691d53ccc8599ac8a467
SHA512e9dcb3dcd6924b61c67af33e88d59bc9d6b2e626234eb09aa18463e09622670d1d220024e9a504b44de23ca88bb426f295968e8d7dd644f49128c8ca7ed4d629
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB