Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10Zorara-v2....64.zip
windows7-x64
1Zorara-v2....64.zip
windows10-2004-x64
1Zorara-v2....ra.dll
windows7-x64
1Zorara-v2....ra.dll
windows10-2004-x64
1Zorara-v2....re.dll
windows7-x64
1Zorara-v2....re.dll
windows10-2004-x64
1Microsoft....re.dll
windows7-x64
1Microsoft....re.dll
windows10-2004-x64
1Zorara-v2....aB.exe
windows7-x64
10Zorara-v2....aB.exe
windows10-2004-x64
10Zorara-v2....UI.exe
windows7-x64
1Zorara-v2....UI.exe
windows10-2004-x64
1Zorara-v2....Env.js
windows7-x64
3Zorara-v2....Env.js
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/02/2025, 12:54
Behavioral task
behavioral1
Sample
Zorara-v2.4.34-x64.zip
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Zorara-v2.4.34-x64.zip
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Zorara-v2.4.34-x64/Zorara.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
Zorara-v2.4.34-x64/Zorara.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Zorara-v2.4.34-x64/Zorara.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Zorara-v2.4.34-x64/Zorara.exe.WebView2/EBWebView/Speech Recognition/1.15.0.1/Microsoft.CognitiveServices.Speech.core.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Microsoft.CognitiveServices.Speech.core.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Microsoft.CognitiveServices.Speech.core.dll
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Zorara-v2.4.34-x64/ZoraraB.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
Zorara-v2.4.34-x64/ZoraraB.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Zorara-v2.4.34-x64/ZoraraUI.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Zorara-v2.4.34-x64/ZoraraUI.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Zorara-v2.4.34-x64/scripts/UNCCheckEnv.js
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
Zorara-v2.4.34-x64/scripts/UNCCheckEnv.js
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Zorara-v2.4.34-x64/ZoraraB.exe
-
Size
231KB
-
MD5
320488aae7f6f97979d69c0e8c364f2e
-
SHA1
c2f7d9466e4c590d63d4ccb2d12bf3b7c8e56a65
-
SHA256
2b5b5c595e2abb3fd2f95aa17727de6340a3e921b310c7f9499f0fb31375e51e
-
SHA512
ff76790d552d708bc39859ae1f542de75662857e179acd8fa4d063ca30fb4e22ee3038aa0c543721a5d03b3c96eeda6843c81b05e7ffa65d80470445ba53ad5e
-
SSDEEP
6144:RloZMLrIkd8g+EtXHkv/iD4NQEmPlO2Z1c1niinVwb8e1mni:joZ0L+EP8NQEmPlO2Z1c1niinKd
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral9/memory/2988-1-0x0000000001320000-0x0000000001360000-memory.dmp family_umbral -
Umbral family
-
pid Process 2656 powershell.exe 2200 powershell.exe 2620 powershell.exe 2700 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts ZoraraB.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2652 wmic.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2988 ZoraraB.exe 2700 powershell.exe 2656 powershell.exe 2200 powershell.exe 2612 powershell.exe 2620 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2988 ZoraraB.exe Token: SeIncreaseQuotaPrivilege 2356 wmic.exe Token: SeSecurityPrivilege 2356 wmic.exe Token: SeTakeOwnershipPrivilege 2356 wmic.exe Token: SeLoadDriverPrivilege 2356 wmic.exe Token: SeSystemProfilePrivilege 2356 wmic.exe Token: SeSystemtimePrivilege 2356 wmic.exe Token: SeProfSingleProcessPrivilege 2356 wmic.exe Token: SeIncBasePriorityPrivilege 2356 wmic.exe Token: SeCreatePagefilePrivilege 2356 wmic.exe Token: SeBackupPrivilege 2356 wmic.exe Token: SeRestorePrivilege 2356 wmic.exe Token: SeShutdownPrivilege 2356 wmic.exe Token: SeDebugPrivilege 2356 wmic.exe Token: SeSystemEnvironmentPrivilege 2356 wmic.exe Token: SeRemoteShutdownPrivilege 2356 wmic.exe Token: SeUndockPrivilege 2356 wmic.exe Token: SeManageVolumePrivilege 2356 wmic.exe Token: 33 2356 wmic.exe Token: 34 2356 wmic.exe Token: 35 2356 wmic.exe Token: SeIncreaseQuotaPrivilege 2356 wmic.exe Token: SeSecurityPrivilege 2356 wmic.exe Token: SeTakeOwnershipPrivilege 2356 wmic.exe Token: SeLoadDriverPrivilege 2356 wmic.exe Token: SeSystemProfilePrivilege 2356 wmic.exe Token: SeSystemtimePrivilege 2356 wmic.exe Token: SeProfSingleProcessPrivilege 2356 wmic.exe Token: SeIncBasePriorityPrivilege 2356 wmic.exe Token: SeCreatePagefilePrivilege 2356 wmic.exe Token: SeBackupPrivilege 2356 wmic.exe Token: SeRestorePrivilege 2356 wmic.exe Token: SeShutdownPrivilege 2356 wmic.exe Token: SeDebugPrivilege 2356 wmic.exe Token: SeSystemEnvironmentPrivilege 2356 wmic.exe Token: SeRemoteShutdownPrivilege 2356 wmic.exe Token: SeUndockPrivilege 2356 wmic.exe Token: SeManageVolumePrivilege 2356 wmic.exe Token: 33 2356 wmic.exe Token: 34 2356 wmic.exe Token: 35 2356 wmic.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeDebugPrivilege 2656 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeDebugPrivilege 2612 powershell.exe Token: SeIncreaseQuotaPrivilege 2112 wmic.exe Token: SeSecurityPrivilege 2112 wmic.exe Token: SeTakeOwnershipPrivilege 2112 wmic.exe Token: SeLoadDriverPrivilege 2112 wmic.exe Token: SeSystemProfilePrivilege 2112 wmic.exe Token: SeSystemtimePrivilege 2112 wmic.exe Token: SeProfSingleProcessPrivilege 2112 wmic.exe Token: SeIncBasePriorityPrivilege 2112 wmic.exe Token: SeCreatePagefilePrivilege 2112 wmic.exe Token: SeBackupPrivilege 2112 wmic.exe Token: SeRestorePrivilege 2112 wmic.exe Token: SeShutdownPrivilege 2112 wmic.exe Token: SeDebugPrivilege 2112 wmic.exe Token: SeSystemEnvironmentPrivilege 2112 wmic.exe Token: SeRemoteShutdownPrivilege 2112 wmic.exe Token: SeUndockPrivilege 2112 wmic.exe Token: SeManageVolumePrivilege 2112 wmic.exe Token: 33 2112 wmic.exe Token: 34 2112 wmic.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2356 2988 ZoraraB.exe 31 PID 2988 wrote to memory of 2356 2988 ZoraraB.exe 31 PID 2988 wrote to memory of 2356 2988 ZoraraB.exe 31 PID 2988 wrote to memory of 2700 2988 ZoraraB.exe 34 PID 2988 wrote to memory of 2700 2988 ZoraraB.exe 34 PID 2988 wrote to memory of 2700 2988 ZoraraB.exe 34 PID 2988 wrote to memory of 2656 2988 ZoraraB.exe 36 PID 2988 wrote to memory of 2656 2988 ZoraraB.exe 36 PID 2988 wrote to memory of 2656 2988 ZoraraB.exe 36 PID 2988 wrote to memory of 2200 2988 ZoraraB.exe 38 PID 2988 wrote to memory of 2200 2988 ZoraraB.exe 38 PID 2988 wrote to memory of 2200 2988 ZoraraB.exe 38 PID 2988 wrote to memory of 2612 2988 ZoraraB.exe 40 PID 2988 wrote to memory of 2612 2988 ZoraraB.exe 40 PID 2988 wrote to memory of 2612 2988 ZoraraB.exe 40 PID 2988 wrote to memory of 2112 2988 ZoraraB.exe 42 PID 2988 wrote to memory of 2112 2988 ZoraraB.exe 42 PID 2988 wrote to memory of 2112 2988 ZoraraB.exe 42 PID 2988 wrote to memory of 1812 2988 ZoraraB.exe 44 PID 2988 wrote to memory of 1812 2988 ZoraraB.exe 44 PID 2988 wrote to memory of 1812 2988 ZoraraB.exe 44 PID 2988 wrote to memory of 1380 2988 ZoraraB.exe 46 PID 2988 wrote to memory of 1380 2988 ZoraraB.exe 46 PID 2988 wrote to memory of 1380 2988 ZoraraB.exe 46 PID 2988 wrote to memory of 2620 2988 ZoraraB.exe 48 PID 2988 wrote to memory of 2620 2988 ZoraraB.exe 48 PID 2988 wrote to memory of 2620 2988 ZoraraB.exe 48 PID 2988 wrote to memory of 2652 2988 ZoraraB.exe 50 PID 2988 wrote to memory of 2652 2988 ZoraraB.exe 50 PID 2988 wrote to memory of 2652 2988 ZoraraB.exe 50
Processes
-
C:\Users\Admin\AppData\Local\Temp\Zorara-v2.4.34-x64\ZoraraB.exe"C:\Users\Admin\AppData\Local\Temp\Zorara-v2.4.34-x64\ZoraraB.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Zorara-v2.4.34-x64\ZoraraB.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1812
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2620
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1C2UDCTQ53I8UQWLH3MW.temp
Filesize7KB
MD57f807e8a82c12170b271fddff14562e8
SHA1e78dceadd3daf250de943f30f01424926e803c58
SHA256c59d41f03bd101fa540f4892b1c0d6f29340323a65103b9e0f273e2b83153ea0
SHA51242a80e176b9c5726cf22550639a09d5bb87fb8334efc09c6da790af9ed6ccbdc85a944195d750fc2800c91355881e1c6766987b8665d75bba7fb6dca3dfa61ce