Overview
overview
7Static
static
3Zorara.zip
windows11-21h2-x64
7Microsoft....re.dll
windows11-21h2-x64
1Microsoft....ms.dll
windows11-21h2-x64
1Microsoft....pf.dll
windows11-21h2-x64
1Newtonsoft.Json.dll
windows11-21h2-x64
1Zorara.dll
windows11-21h2-x64
5ZoraraUI.exe
windows11-21h2-x64
1ZoraraUI.exe
windows11-21h2-x64
6bin/Monaco/index.html
windows11-21h2-x64
6bin/Monaco...ain.js
windows11-21h2-x64
3bin/Monaco...lua.js
windows11-21h2-x64
3bin/Monaco...ain.js
windows11-21h2-x64
3bin/Monaco....de.js
windows11-21h2-x64
3bin/Monaco....es.js
windows11-21h2-x64
3bin/Monaco....fr.js
windows11-21h2-x64
3bin/Monaco....it.js
windows11-21h2-x64
3bin/Monaco....ja.js
windows11-21h2-x64
3bin/Monaco...nls.js
windows11-21h2-x64
3bin/Monaco....ko.js
windows11-21h2-x64
3bin/Monaco....ru.js
windows11-21h2-x64
3bin/Monaco...-cn.js
windows11-21h2-x64
3bin/Monaco...-tw.js
windows11-21h2-x64
3bin/Monaco...der.js
windows11-21h2-x64
3bin/editor.js
windows11-21h2-x64
3libcrypto-3-x64.dll
windows11-21h2-x64
1libssl-3-x64.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows11-21h2-x64
1runtimes/w...er.dll
windows11-21h2-x64
3scripts/IY.js
windows11-21h2-x64
3scripts/UNCTest.js
windows11-21h2-x64
3scripts/unnamedesp.js
windows11-21h2-x64
3Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/11/2024, 21:03
Static task
static1
Behavioral task
behavioral1
Sample
Zorara.zip
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Microsoft.Web.WebView2.Core.dll
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
Microsoft.Web.WebView2.WinForms.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
Microsoft.Web.WebView2.Wpf.dll
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
Newtonsoft.Json.dll
Resource
win11-20241007-en
Behavioral task
behavioral6
Sample
Zorara.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
ZoraraUI.exe
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
ZoraraUI.exe
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
bin/Monaco/index.html
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
bin/Monaco/vs/base/worker/workerMain.js
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
bin/Monaco/vs/basic-languages/lua/lua.js
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
bin/Monaco/vs/editor/editor.main.js
Resource
win11-20241023-en
Behavioral task
behavioral13
Sample
bin/Monaco/vs/editor/editor.main.nls.de.js
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
bin/Monaco/vs/editor/editor.main.nls.es.js
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
bin/Monaco/vs/editor/editor.main.nls.fr.js
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
bin/Monaco/vs/editor/editor.main.nls.it.js
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
bin/Monaco/vs/editor/editor.main.nls.ja.js
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
bin/Monaco/vs/editor/editor.main.nls.js
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
bin/Monaco/vs/editor/editor.main.nls.ko.js
Resource
win11-20241007-en
Behavioral task
behavioral20
Sample
bin/Monaco/vs/editor/editor.main.nls.ru.js
Resource
win11-20241007-en
Behavioral task
behavioral21
Sample
bin/Monaco/vs/editor/editor.main.nls.zh-cn.js
Resource
win11-20241007-en
Behavioral task
behavioral22
Sample
bin/Monaco/vs/editor/editor.main.nls.zh-tw.js
Resource
win11-20241023-en
Behavioral task
behavioral23
Sample
bin/Monaco/vs/loader.js
Resource
win11-20241007-en
Behavioral task
behavioral24
Sample
bin/editor.js
Resource
win11-20241007-en
Behavioral task
behavioral25
Sample
libcrypto-3-x64.dll
Resource
win11-20241007-en
Behavioral task
behavioral26
Sample
libssl-3-x64.dll
Resource
win11-20241007-en
Behavioral task
behavioral27
Sample
runtimes/win-arm64/native/WebView2Loader.dll
Resource
win11-20241007-en
Behavioral task
behavioral28
Sample
runtimes/win-x64/native/WebView2Loader.dll
Resource
win11-20241007-en
Behavioral task
behavioral29
Sample
runtimes/win-x86/native/WebView2Loader.dll
Resource
win11-20241007-en
Behavioral task
behavioral30
Sample
scripts/IY.js
Resource
win11-20241007-en
Behavioral task
behavioral31
Sample
scripts/UNCTest.js
Resource
win11-20241007-en
Behavioral task
behavioral32
Sample
scripts/unnamedesp.js
Resource
win11-20241007-en
General
-
Target
Zorara.zip
-
Size
16.5MB
-
MD5
4973d273fcbbdbd2fc55a6a88446870b
-
SHA1
dae039628972670c02a44ee78f096f7e7d8eff36
-
SHA256
4bafb0b0d4e309b3402fdd68ebbb385ce111798566b658de5c4542205661ca00
-
SHA512
b8b2e63c0bb0fad671e2291cb55cb82b3dc93c0c57824a1dc8b0635b461daa7a1f001f27ce2229e40223367ed5028cc43c9400b0a6378f5e167ffa9ead59ce81
-
SSDEEP
393216:M+Fw1giC8hSm/SiCBQE+Xdyy+eICj9syG5aCvVH:Hw1gifSmaiCKdyRLO0H
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 3128 ZoraraUI.exe 568 ZoraraUI.exe 4368 ZoraraUI.exe 1408 ZoraraUI.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4384 7zFM.exe 4384 7zFM.exe 4384 7zFM.exe 4384 7zFM.exe 4384 7zFM.exe 4384 7zFM.exe 4384 7zFM.exe 4384 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4384 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeRestorePrivilege 4384 7zFM.exe Token: 35 4384 7zFM.exe Token: SeSecurityPrivilege 4384 7zFM.exe Token: SeSecurityPrivilege 4384 7zFM.exe Token: SeSecurityPrivilege 4384 7zFM.exe Token: SeSecurityPrivilege 4384 7zFM.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 4384 7zFM.exe 4384 7zFM.exe 4384 7zFM.exe 4384 7zFM.exe 4384 7zFM.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4960 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4384 wrote to memory of 3128 4384 7zFM.exe 80 PID 4384 wrote to memory of 3128 4384 7zFM.exe 80 PID 4384 wrote to memory of 568 4384 7zFM.exe 83 PID 4384 wrote to memory of 568 4384 7zFM.exe 83 PID 4384 wrote to memory of 4368 4384 7zFM.exe 84 PID 4384 wrote to memory of 4368 4384 7zFM.exe 84 PID 4384 wrote to memory of 1408 4384 7zFM.exe 89 PID 4384 wrote to memory of 1408 4384 7zFM.exe 89
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Zorara.zip"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\7zO02128738\ZoraraUI.exe"C:\Users\Admin\AppData\Local\Temp\7zO02128738\ZoraraUI.exe"2⤵
- Executes dropped EXE
PID:3128
-
-
C:\Users\Admin\AppData\Local\Temp\7zO021E6D48\ZoraraUI.exe"C:\Users\Admin\AppData\Local\Temp\7zO021E6D48\ZoraraUI.exe"2⤵
- Executes dropped EXE
PID:568
-
-
C:\Users\Admin\AppData\Local\Temp\7zO021FC358\ZoraraUI.exe"C:\Users\Admin\AppData\Local\Temp\7zO021FC358\ZoraraUI.exe"2⤵
- Executes dropped EXE
PID:4368
-
-
C:\Users\Admin\AppData\Local\Temp\7zO02189E29\ZoraraUI.exe"C:\Users\Admin\AppData\Local\Temp\7zO02189E29\ZoraraUI.exe"2⤵
- Executes dropped EXE
PID:1408
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:3328
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4960
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2512
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\811737ac-1172-486f-b007-f644d053488d.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5ad7a569bafd3a938fe348f531b8ef332
SHA17fdd2f52d07640047bb62e0f3d3c946ddd85c227
SHA256f0e06109256d5577e9f62db2c398974c5002bd6d08892f20517760601b705309
SHA512b762bae338690082d817b3008144926498a1bd2d6d99be33e513c43515808f9a3184bd10254e5c6a1ff90a9211653f066050249030ad9fe0460ec88335b3d423
-
Filesize
254KB
MD5aeb703ddf25377135af6e4675793a1c9
SHA1e9f43283ba04a9c30d045ca064d2935d053114ba
SHA2566b9da80d8877b04e5aa3a04790d3cbed8cf47cad2871997755f198ba674aa026
SHA512191de5176cf7efbc0a8cf1b0f79c49754874ce48d7415615d484e9c7ba26d3184580309afd013cc437b239885f2c2a758846e27bec2d59a542a9647bcd7cd739