dfa1a46d34856fa0d06b6c6bf7581439f88342b4e80d2e12f71069873a66b955

Analysis

max time kernel
151s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2023, 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.128776e83e3d08a07d4572513867d950.exe
Size

220KB
MD5

128776e83e3d08a07d4572513867d950
SHA1

abba4635064e8a8814bbd8a04341437741ef9cac
SHA256

dfa1a46d34856fa0d06b6c6bf7581439f88342b4e80d2e12f71069873a66b955
SHA512

e3bbac6401f02857f5a615cc2451cd54f84393a81f19d6badb1d5d9975416591c01f695ebf90ed2b6ebf4f8c7f4a90e1059a812f550b78d77f07e835c1e197d6
SSDEEP

3072:6e7WpXR9B3NZWGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2Fr:Rqz9ZNoShcHUaV

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (306) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1680	Zombie.exe
4780	_cpack.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	NEAS.128776e83e3d08a07d4572513867d950.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	NEAS.128776e83e3d08a07d4572513867d950.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msador28.tlb.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msdfmap.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tabskb.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msadrh15.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadcer.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msix.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	Zombie.exe
File created	C:\Program Files\AssertGrant.vstx.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\bg-BG\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.id-id.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msdaprsr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msaddsr.dll.mui.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3580 wrote to memory of 1680	3580	NEAS.128776e83e3d08a07d4572513867d950.exe	88
PID 3580 wrote to memory of 1680	3580	NEAS.128776e83e3d08a07d4572513867d950.exe	88
PID 3580 wrote to memory of 1680	3580	NEAS.128776e83e3d08a07d4572513867d950.exe	88
PID 3580 wrote to memory of 4780	3580	NEAS.128776e83e3d08a07d4572513867d950.exe	89
PID 3580 wrote to memory of 4780	3580	NEAS.128776e83e3d08a07d4572513867d950.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.128776e83e3d08a07d4572513867d950.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.128776e83e3d08a07d4572513867d950.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3580
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1680
- C:\Users\Admin\AppData\Local\Temp\_cpack.exe
  "_cpack.exe"
  2⤵
  - Executes dropped EXE
  PID:4780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-984744499-3605095035-265325720-1000\desktop.ini.exe

Filesize
81KB

MD5
bc5568d630ed69be0ea0f4b4f8d4f646

SHA1
d78393856f7bfa9e300c2d8a4d0d0b4138e6f1b7

SHA256
3124edeac140d354f1b74f8ef93d3c9ba3b1392831e62b67d2a99f016cbb787d

SHA512
5612e2de4787137791250b4c503723f75edec2db2d36e51a58d966b6f1ede8e3e62506a743a0bf3d462dd5208ec76f83b716d20c328758fc395ff27c3d07e48f

Download Submit
C:\$Recycle.Bin\S-1-5-21-984744499-3605095035-265325720-1000\desktop.ini.tmp

Filesize
81KB

MD5
bc5568d630ed69be0ea0f4b4f8d4f646

SHA1
d78393856f7bfa9e300c2d8a4d0d0b4138e6f1b7

SHA256
3124edeac140d354f1b74f8ef93d3c9ba3b1392831e62b67d2a99f016cbb787d

SHA512
5612e2de4787137791250b4c503723f75edec2db2d36e51a58d966b6f1ede8e3e62506a743a0bf3d462dd5208ec76f83b716d20c328758fc395ff27c3d07e48f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_cpack.exe

Filesize
140KB

MD5
caad373422b474737f4d76fb82379581

SHA1
6804be1ae8bfd3858e0053915f75d4b611790bc5

SHA256
22c0d54e96431ebae4d40546f4efe6af61d1a9644710f93dc32ec2ca6cf2ba75

SHA512
dbaba0bc94aaeddb9811b0b9fd923f763ef8c7e290153e21e295230fdbe9c683dbf0b096eda3a3eb06e4ff9733cb3e9906737a1b5ee8e6af034680c198b95dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_cpack.exe

Filesize
140KB

MD5
caad373422b474737f4d76fb82379581

SHA1
6804be1ae8bfd3858e0053915f75d4b611790bc5

SHA256
22c0d54e96431ebae4d40546f4efe6af61d1a9644710f93dc32ec2ca6cf2ba75

SHA512
dbaba0bc94aaeddb9811b0b9fd923f763ef8c7e290153e21e295230fdbe9c683dbf0b096eda3a3eb06e4ff9733cb3e9906737a1b5ee8e6af034680c198b95dd5

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
80KB

MD5
327fae54b25f17c89886114f5f3d64c9

SHA1
77664a47aed46d07260a17d2792be5ff9166e1f4

SHA256
e7769436a31110d0606781b768ea5861b8112528d52de2fc959674e3e056ebc2

SHA512
a75ead5b73ba689eaccd4584a6a2642709d8fdce40d0341dfa1f1ef423b53f92753a88713853085211158ed32a2fb8a590d053df9f6134513b6ab342722e19bc

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
80KB

MD5
327fae54b25f17c89886114f5f3d64c9

SHA1
77664a47aed46d07260a17d2792be5ff9166e1f4

SHA256
e7769436a31110d0606781b768ea5861b8112528d52de2fc959674e3e056ebc2

SHA512
a75ead5b73ba689eaccd4584a6a2642709d8fdce40d0341dfa1f1ef423b53f92753a88713853085211158ed32a2fb8a590d053df9f6134513b6ab342722e19bc

Download Submit
memory/4780-15-0x0000000000690000-0x00000000006B8000-memory.dmp

Filesize
160KB

Download
memory/4780-19-0x00007FFBE5F50000-0x00007FFBE6A11000-memory.dmp

Filesize
10.8MB

Download
memory/4780-272-0x00007FFBE5F50000-0x00007FFBE6A11000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads