c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b

General

Target

c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe
Size

356KB
MD5

cad7609bfd0a084e26e46db6b5d876ec
SHA1

c895d7a69b4922c39b832c4447b3360d459236fd
SHA256

c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b
SHA512

30d13f37474ed93e6c6906c0183b99befa8f8c4f37217b9f30f3a190cd6f0fa2449f46e1d904a6d80526f61217aac585dd15c6ed69de75a2e24a1ebe4bdb9b5e
SSDEEP

6144:ndW+Dffz1gUZ3sOeNw0VqIJ/uJn9tvq3v3/sSQJw1Tn:dW+Dfhg0cvd5JIDvTJw1L

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5058) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 2 IoCs

Processes:

Zombie.exe_7z.exe

pid process

2876 Zombie.exe
5028 _7z.exe

pid	process
2876	Zombie.exe
5028	_7z.exe

Drops file in System32 directory 2 IoCs

Processes:

c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\COPYRIGHT.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Pipes.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.HttpListener.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.RegularExpressions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Emit.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power View Excel Add-in\Microsoft.PowerBI.AdomdDataExtension.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tabskb.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019DemoR_BypassTrial180-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL077.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvSubsystemController.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\host\fxr\7.0.16\hostfxr.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordcnvr.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\host\fxr\8.0.2\hostfxr.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\joni.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.DataExtensions.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.runtimeconfig.json.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Initialization.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe

description	pid	process	target process
PID 5076 wrote to memory of 2876	5076	c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe	Zombie.exe
PID 5076 wrote to memory of 2876	5076	c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe	Zombie.exe
PID 5076 wrote to memory of 2876	5076	c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe	Zombie.exe
PID 5076 wrote to memory of 5028	5076	c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe	_7z.exe
PID 5076 wrote to memory of 5028	5076	c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe	_7z.exe
PID 5076 wrote to memory of 5028	5076	c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe	_7z.exe

C:\Users\Admin\AppData\Local\Temp\c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe
"C:\Users\Admin\AppData\Local\Temp\c0302061eaffab35f993eec903d2b6d85463fcc5b73d9bdac4e1332a4c48455b.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2876
- C:\Users\Admin\AppData\Local\Temp\_7z.exe
  "_7z.exe"
  2⤵
  - Executes dropped EXE
  PID:5028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-259785868-298165991-4178590326-1000\desktop.ini.tmp

Filesize
73KB

MD5
0ab93d355a22cf1952e35736e8a5df57

SHA1
f1767345416d05736572ca33160ee0fc5b24b34d

SHA256
6c50e9df15fb0140f243f330f2709c3ad164d84525a46f4f16a775970436583b

SHA512
b20c94bf92e2aa2f9302b327596c6a90c1faa3246aa8bce5a741b5af3b42ea51c5ea66d7d5d9e3c78d33b5cc004dcad0ded560569a5dc48941d6b0f99e1bdde1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_7z.exe

Filesize
284KB

MD5
a42b35f975d88c1370a7aff084ee57a7

SHA1
bee1408fe0b15f6f719f003e46aee5ec424cf608

SHA256
56cc9e7e3767c0cffae8161bf0ad13457487c1b422e2879b897dbd4bab115776

SHA512
b92d05515e18277db660118934e70678ee2a3bb66005bad19bb417ffaedb22a63727a5a697ca3ac0f6c48f6f5593ba45ab80f4ebdc0eaed10d80b7af04d45b23

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
72KB

MD5
7b216b687adea8e3dacdb29dce7119ce

SHA1
c63ceef73ea305774b7365e08b15c865fd79c815

SHA256
cd2b1c3bf9ba7faa3cf4f3f4454cc3330a85f40beb1318ab38abe395751d9dc2

SHA512
f50c5c01b322fa60a5528029f07150609b46be31521e4537b0a63e755c1422896b7b8b551629e02b950240ac2b0e99625d5838f8fd77da9f16234e626a688c80

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads