028efedeab3a9c746ee580dda54ef9867aa288a8d9f3ec063e06933cb2b2ee56

Analysis

max time kernel
152s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe
Size

193KB
MD5

0b487e3a036de4f3f84986ea3035e2f0
SHA1

6b0ec4b54a2c9d8e02872ef9d8eb8110283b552e
SHA256

028efedeab3a9c746ee580dda54ef9867aa288a8d9f3ec063e06933cb2b2ee56
SHA512

1d277cbbb73184c49f2b4b766e8614758e0f3d6af111114977625d74ebf0df52f252cf388c6dd27c515cc7f1ca38b7e49efcf87e0a9c385501c43206a953eb06
SSDEEP

3072:6e7WpMNca3rytOkWpXfnYRl2l/9HSFHzJ0UwUhQ7XhxS:RqKB+tOkWKR0iJ0Ux

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (286) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2664	_checksum.exe
2652	Zombie.exe

Loads dropped DLL 3 IoCs

pid	Process
3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe
3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe
3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\FlickLearningWizard.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\offset.ax.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_SelectionSubpicture.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\zh-cn.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IpsMigrationPlugin.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\pagecurl.png.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ro.pak.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Graph.emf.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaremr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\DVDMaker.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\FlickLearningWizard.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\gl.txt.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp.tmp	Zombie.exe
File created	C:\Program Files\BlockOut.dwfx.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipRes.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\es-ES\wab32res.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_SelectionSubpicture.png.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2664	3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe	30
PID 3020 wrote to memory of 2664	3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe	30
PID 3020 wrote to memory of 2664	3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe	30
PID 3020 wrote to memory of 2664	3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe	30
PID 3020 wrote to memory of 2652	3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe	28
PID 3020 wrote to memory of 2652	3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe	28
PID 3020 wrote to memory of 2652	3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe	28
PID 3020 wrote to memory of 2652	3020	NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0b487e3a036de4f3f84986ea3035e2f0_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2652
- C:\Users\Admin\AppData\Local\Temp\_checksum.exe
  "_checksum.exe"
  2⤵
  - Executes dropped EXE
  PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-86725733-3001458681-3405935542-1000\desktop.ini.tmp

Filesize
155KB

MD5
38aaed3c503f647f7863b07fee20b721

SHA1
59377d0212a4e4a2c8310e031aa8facee99d16a0

SHA256
da1a3a62bb03f8dd0f9c9ae423c75d041c9aff55e3face44151095e683636516

SHA512
d05b639837f6ab2a1b3509d34b8dfa02378550ccf2aa29a9688f056027d772924d2fe34d41d576826a5067d72e1e5990f118430ed6cd303bf7378ee06c2b14cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_checksum.exe

Filesize
37KB

MD5
371627fd939bb54ed26f473ca54e718f

SHA1
3a6910295ae9d1fe388b7572736b8bdfc6e0d111

SHA256
b5481e424246a174456add0132427df3a7cd4105f5769835cdf597966c7c0b61

SHA512
ff7ea5ae445089ffa808c97e23c620313dd267994b343176c0cb9f8098aace1d12d9212b96611fdf97c974ef94f866b817aed9c0e5f4f195234e7d8d4ec3f8cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_checksum.exe

Filesize
37KB

MD5
371627fd939bb54ed26f473ca54e718f

SHA1
3a6910295ae9d1fe388b7572736b8bdfc6e0d111

SHA256
b5481e424246a174456add0132427df3a7cd4105f5769835cdf597966c7c0b61

SHA512
ff7ea5ae445089ffa808c97e23c620313dd267994b343176c0cb9f8098aace1d12d9212b96611fdf97c974ef94f866b817aed9c0e5f4f195234e7d8d4ec3f8cd

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
155KB

MD5
36a0ba4e38a628c8eb1813abf7a4f5d8

SHA1
9bc292b8a4de6a43dc40a97e1a51e3faf5c96da5

SHA256
2d8a3aaafdaff31daa02ba5658889a1b272e495b3d19e5b2a176544845aa67be

SHA512
57a48ad3965073b5032c109478626044eacc30fd577ccac267aa5c2a74f8840ba3523a62598d4a2f7f605cbf54c1967ac3ea4fcd0bbd17e848a4d7ca8db3d096

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
155KB

MD5
36a0ba4e38a628c8eb1813abf7a4f5d8

SHA1
9bc292b8a4de6a43dc40a97e1a51e3faf5c96da5

SHA256
2d8a3aaafdaff31daa02ba5658889a1b272e495b3d19e5b2a176544845aa67be

SHA512
57a48ad3965073b5032c109478626044eacc30fd577ccac267aa5c2a74f8840ba3523a62598d4a2f7f605cbf54c1967ac3ea4fcd0bbd17e848a4d7ca8db3d096

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
155KB

MD5
36a0ba4e38a628c8eb1813abf7a4f5d8

SHA1
9bc292b8a4de6a43dc40a97e1a51e3faf5c96da5

SHA256
2d8a3aaafdaff31daa02ba5658889a1b272e495b3d19e5b2a176544845aa67be

SHA512
57a48ad3965073b5032c109478626044eacc30fd577ccac267aa5c2a74f8840ba3523a62598d4a2f7f605cbf54c1967ac3ea4fcd0bbd17e848a4d7ca8db3d096

Download Submit
\Users\Admin\AppData\Local\Temp\_checksum.exe

Filesize
37KB

MD5
371627fd939bb54ed26f473ca54e718f

SHA1
3a6910295ae9d1fe388b7572736b8bdfc6e0d111

SHA256
b5481e424246a174456add0132427df3a7cd4105f5769835cdf597966c7c0b61

SHA512
ff7ea5ae445089ffa808c97e23c620313dd267994b343176c0cb9f8098aace1d12d9212b96611fdf97c974ef94f866b817aed9c0e5f4f195234e7d8d4ec3f8cd

Download Submit
\Windows\SysWOW64\Zombie.exe

Filesize
155KB

MD5
36a0ba4e38a628c8eb1813abf7a4f5d8

SHA1
9bc292b8a4de6a43dc40a97e1a51e3faf5c96da5

SHA256
2d8a3aaafdaff31daa02ba5658889a1b272e495b3d19e5b2a176544845aa67be

SHA512
57a48ad3965073b5032c109478626044eacc30fd577ccac267aa5c2a74f8840ba3523a62598d4a2f7f605cbf54c1967ac3ea4fcd0bbd17e848a4d7ca8db3d096

Download Submit
\Windows\SysWOW64\Zombie.exe

Filesize
155KB

MD5
36a0ba4e38a628c8eb1813abf7a4f5d8

SHA1
9bc292b8a4de6a43dc40a97e1a51e3faf5c96da5

SHA256
2d8a3aaafdaff31daa02ba5658889a1b272e495b3d19e5b2a176544845aa67be

SHA512
57a48ad3965073b5032c109478626044eacc30fd577ccac267aa5c2a74f8840ba3523a62598d4a2f7f605cbf54c1967ac3ea4fcd0bbd17e848a4d7ca8db3d096

Download Submit
memory/2664-19-0x00000000000E0000-0x00000000000EE000-memory.dmp

Filesize
56KB

Download
memory/2664-20-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/2664-35-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download