Overview

overview

8

Static

static

3

setup_zeda...te.exe

windows10-2004-x64

6

setup_zeda...te.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...sh.dll

windows10-2004-x64

3

$PLUGINSDI...sh.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-ltsc_2024-x64

3

CrashRpt.dll

windows10-2004-x64

3

CrashRpt.dll

windows11-ltsc_2024-x64

3

CrashSender.exe

windows10-2004-x64

3

CrashSender.exe

windows11-ltsc_2024-x64

3

IEFrame.dll

windows10-2004-x64

3

IEFrame.dll

windows11-ltsc_2024-x64

8

ITSigner.psm.exe

windows10-2004-x64

1

ITSigner.psm.exe

windows11-ltsc_2024-x64

1

ctl3d32.dll

windows10-2004-x64

3

ctl3d32.dll

windows11-ltsc_2024-x64

3

dbghelp.dll

windows10-2004-x64

3

dbghelp.dll

windows11-ltsc_2024-x64

8

dtbl32.dll

windows10-2004-x64

3

dtbl32.dll

windows11-ltsc_2024-x64

3

eav.ps1

windows10-2004-x64

3

eav.ps1

windows11-ltsc_2024-x64

3

ebvbxa_shared.dll

windows10-2004-x64

3

ebvbxa_shared.dll

windows11-ltsc_2024-x64

3

formread.exe

windows10-2004-x64

3

formread.exe

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    setup_zedalforms_corporate.exe
  • Size 18.4MB
  • Sample260622-phjagsbz5k
  • SHA256 5e9c56b825d5aeea91af3ddc84a26bf2f06357c8056558a322f4b19db0f80a4e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutioninstallerpersistenceprivilege_escalationransomwarespyware

Malware Config

Targets

    • Target
      setup_zedalforms_corporate.exe
    • Size 18.4MB
    • SHA256 5e9c56b825d5aeea91af3ddc84a26bf2f06357c8056558a322f4b19db0f80a4e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoverypersistenceprivilege_escalationransomware

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/AdvSplash.dll
    • Size 6KB
    • SHA256 eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 14KB
    • SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/LangDLL.dll
    • Size 5KB
    • SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      CrashRpt.dll
    • Size 72KB
    • SHA256 6fc4f36e4f8636d1352a8615b351b6241ea56e4171e7289abfdb816feea085d1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      CrashSender.exe
    • Size 564KB
    • SHA256 04a43982e7dd0e55ea2461df1ba6f72450ae47b17d365796c8bdfaa767d8ac31
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      IEFrame.ocx
    • Size 292KB
    • SHA256 2923af0c1f7615ec57c4be00b95011b9e38793d4fb969877e9581844965e5c4d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral17behavioral18
    • Target
      ITSigner.psm.exe
    • Size 5.5MB
    • SHA256 e5b1df0ef5031048fb67d29c31cdc78069a7c06003bc313133fa11a25798a937
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      ctl3d32.dll
    • Size 26KB
    • SHA256 94ef91b4c7864bd1ecc0db099e58298708bc5d22da40132ebb1c17feb4675964
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      dbghelp.dll
    • Size 1.0MB
    • SHA256 9a26ffaffb26fa6549c6da75f76238a903ca723f9dad356fba8d91067fe312fd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral23behavioral24
    • Target
      dtbl32.dll
    • Size 344KB
    • SHA256 f5375b4279d92105b04a377f64df31d0e37f0c8dd9aa83ac402e93f25ea409ea
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      eav.dat
    • Size 91KB
    • SHA256 2fff92c8233d866f4bcd2fb2af66f10ce0fddbf1a67962eab5d31cd16c2f48ee
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral27behavioral28
    • Target
      ebvbxa_shared.dll
    • Size 4.5MB
    • SHA256 370810309c43c441dc16d14251cc1cde94222d84a0575ebd56e6133ae7f4c99c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      formread.exe
    • Size 9.6MB
    • SHA256 62b2914f3094795a98af493868826a8b13ce548651cff3ad1a95716119813811
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Installer Packages

1
T1546.016

Defense Evasion

Modify Registry

3
T1112

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

4
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

installer
Score
3/10

behavioral1

discoverypersistenceprivilege_escalationransomware
Score
6/10

behavioral2

discoverypersistenceprivilege_escalationransomware
Score
6/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

adwarediscoverypersistenceransomwarespyware
Score
8/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

execution
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10