Overview
overview
10Static
static
3Zorara.zip
windows7-x64
1Zorara.zip
windows10-2004-x64
10Application.bat
windows7-x64
6Application.bat
windows10-2004-x64
10cfg.js
windows7-x64
3cfg.js
windows10-2004-x64
3lua51.dll
windows7-x64
1lua51.dll
windows10-2004-x64
1luajit.exe
windows7-x64
1luajit.exe
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 19:04
Static task
static1
Behavioral task
behavioral1
Sample
Zorara.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Zorara.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Application.bat
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Application.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
cfg.js
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
cfg.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
lua51.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
lua51.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
luajit.exe
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
luajit.exe
Resource
win10v2004-20241007-en
General
-
Target
Zorara.zip
-
Size
498KB
-
MD5
935eca784190b019bddfcbd9977c9416
-
SHA1
7dc1869d79a110f7394afe4b93c06b586185139d
-
SHA256
6d11d8339ed8917190ba15dfbdf12c46d0a9d90b4b680edf54a8c65585e76e74
-
SHA512
624f2b2348a4ab37855cd238b244d99f9dfdf4cfd7c8bfb2e55ad72aeee161db1d8a9e961e6e31f6be5f52a0f9c0562f49e484dc9763540c7c45ea819a9cdae3
-
SSDEEP
12288:UmCAJEZ64ZZnv7zOCcf+X/N4mUiRvyPqBmKUU+zSy:Uc4ZZvOPBi5/BmKUBWy
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7zFM.exepid Process 2408 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
7zFM.exedescription pid Process Token: SeRestorePrivilege 2408 7zFM.exe Token: 35 2408 7zFM.exe Token: SeSecurityPrivilege 2408 7zFM.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
7zFM.exepid Process 2408 7zFM.exe 2408 7zFM.exe