e0d3f82b88ac429f7d88c2ec3afc3a45a43986daeb60dfb8ed718ba14f5182dd

Analysis

max time kernel
156s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
16/11/2023, 08:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe
Size

700KB
MD5

2403818fc0fcfbfe3e58e729eacdfd50
SHA1

66380c1b5dc72b4f7de17e26b6e4f6caf99a56cf
SHA256

e0d3f82b88ac429f7d88c2ec3afc3a45a43986daeb60dfb8ed718ba14f5182dd
SHA512

35a3c306bf0bf42c4e8f2e28ddc16ec3f1e1126a06a225c39a6041dcce254aca27e570567f3fa53febebfa12602138d1c59f6504e6c2ea2a4aaa1604de0aa19b
SSDEEP

12288:BOVo4A1fgyv8godP1PwPvw2M5ONeJuMqzBDJkk2ERvT8MPAf/O6s:BOVkN2tonZ79MqFDJkxqo4Af/3s

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (985) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4476	Zombie.exe
3008	_7z.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\verify.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\jdwp.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\lib\orb.idl.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\lib\sa-jdi.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\tr.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\nashorn.jar.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaremr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\JavaAccessBridge-64.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\tabskb.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\it-IT\iexplore.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\classlist.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\CIEXYZ.pf.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\ja-JP\iexplore.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\adcjavas.inc.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\oledb32r.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\LINEAR_RGB.pf.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadce.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-debug-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\VC\msdia90.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2ssv.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\ShapeCollector.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java_crw_demo.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 4476	1568	NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe	87
PID 1568 wrote to memory of 4476	1568	NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe	87
PID 1568 wrote to memory of 4476	1568	NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe	87
PID 1568 wrote to memory of 3008	1568	NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe	88
PID 1568 wrote to memory of 3008	1568	NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe	88
PID 1568 wrote to memory of 3008	1568	NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2403818fc0fcfbfe3e58e729eacdfd50.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4476
- C:\Users\Admin\AppData\Local\Temp\_7z.exe
  "_7z.exe"
  2⤵
  - Executes dropped EXE
  PID:3008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1873812795-1433807462-1429862679-1000\desktop.ini.exe

Filesize
376KB

MD5
5abfd27701d76878c138edd172f74c6a

SHA1
03a8683045a826b345298fdec5bb20192ebeb936

SHA256
5ceda77475509fa2fe00d6c8abb3fe2eca771cf2cabde30a9241b8e0aa6a2077

SHA512
1b80e739b89b36dfe93521c2fec11d58eab77fa37f2b55ae8592b0d6fa328c3d28dc73033d81fcd83d2be3204c52dc823f4c640ddae7179e904c984fb0dd5d87

Download Submit
C:\$Recycle.Bin\S-1-5-21-1873812795-1433807462-1429862679-1000\desktop.ini.tmp

Filesize
376KB

MD5
5abfd27701d76878c138edd172f74c6a

SHA1
03a8683045a826b345298fdec5bb20192ebeb936

SHA256
5ceda77475509fa2fe00d6c8abb3fe2eca771cf2cabde30a9241b8e0aa6a2077

SHA512
1b80e739b89b36dfe93521c2fec11d58eab77fa37f2b55ae8592b0d6fa328c3d28dc73033d81fcd83d2be3204c52dc823f4c640ddae7179e904c984fb0dd5d87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_7z.exe

Filesize
324KB

MD5
7187ae605f4dce14bb23ea2623956335

SHA1
f7c1df33b875c98f41dcde24117d89d42d25b7ce

SHA256
9e2631c19b243c28b0980607ced2540e9447b1166572483475547c1a9dd4ac0e

SHA512
f64522e2fb6bb61884fe53c34e79b355efb9ec33c02b2cd67d729af7d763e7b3873a5c7ce6ac7bb4567e6bcf8c70cadbc66f511e8bb151ab05096a832032bc8f

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
376KB

MD5
1729dad8bdc82256422546bab492002d

SHA1
903eac92d121514ce0d1c078dc79962325b8c0b6

SHA256
c7a42850c14be02bb924bc8315de7d17023c18410feb23dff733494785d9e5eb

SHA512
d4a968fbd6d43aa7dfab7751aa479fbf0a6fd13c910cc4f0c0bbfc409ff952ac0556d221deec3d000a5475cf34e560e8a36dece99cf7d4a1a0c583f0b7d34453

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
376KB

MD5
1729dad8bdc82256422546bab492002d

SHA1
903eac92d121514ce0d1c078dc79962325b8c0b6

SHA256
c7a42850c14be02bb924bc8315de7d17023c18410feb23dff733494785d9e5eb

SHA512
d4a968fbd6d43aa7dfab7751aa479fbf0a6fd13c910cc4f0c0bbfc409ff952ac0556d221deec3d000a5475cf34e560e8a36dece99cf7d4a1a0c583f0b7d34453

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads