81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f

General

Target

81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe
Size

682KB
MD5

f849e424deb6622c9872620e6bb2a5cf
SHA1

c1ffd0087ef183737e006984b9a137de724c95c3
SHA256

81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f
SHA512

81d66e9bf27ac10c0d44cee608be3af753e31118a7852a93ded3433ef7d2eb36aa325cc1021b9f99727493997cb33d788a6e08d49c5926b871ffebd5c0f3de1c
SSDEEP

12288:7AIuZAIuOYS3ycUVRMstsD5pAfujVvaYMLc9RS/o:IYS3ycU/zt45W6vdLR

Score

9^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MpCmdRun.exe	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Renames multiple (4854) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1612-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\Windows\SysWOW64\Zombie.exe	UPX
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	UPX
behavioral2/memory/1612-20-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

Processes:

Zombie.exe_MpCmdRun.exe

pid process

2124 Zombie.exe
3560 _MpCmdRun.exe

pid	process
2124	Zombie.exe
3560	_MpCmdRun.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1612-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\Windows\SysWOW64\Zombie.exe	upx
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp	upx
behavioral2/memory/1612-20-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mip_core.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\msquic.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\oledb32r.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.Messages.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdCO365R_Subscription-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado60.tlb.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jpeg.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwgst.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.OpenSsl.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.Win32.Registry.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaTypewriterRegular.ttf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\COPYRIGHT.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Xml.Linq.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\msotelemetryintl.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-console-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\kn.pak.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\VisualElements\LogoBeta.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Grace-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN110.XML.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp2-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\OFFICE.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.IO.Packaging.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe

description	pid	process	target process
PID 1612 wrote to memory of 2124	1612	81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe	Zombie.exe
PID 1612 wrote to memory of 2124	1612	81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe	Zombie.exe
PID 1612 wrote to memory of 2124	1612	81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe	Zombie.exe
PID 1612 wrote to memory of 3560	1612	81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe	_MpCmdRun.exe
PID 1612 wrote to memory of 3560	1612	81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe	_MpCmdRun.exe

C:\Users\Admin\AppData\Local\Temp\81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe
"C:\Users\Admin\AppData\Local\Temp\81feec4a201a83d7dc490de813c2f0739d5d9e888c72de67052e1216fcaaaa8f.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2124

C:\Users\Admin\AppData\Local\Temp\_MpCmdRun.exe
"_MpCmdRun.exe"
2⤵
- Executes dropped EXE
PID:3560

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
Filesize
130KB

MD5
28ab3947ffc2a7e85262dd7679ed8346

SHA1
4f380e88ce50abb1fd4e0a4daf232b3d536cdada

SHA256
5c7bcd291d8d215513ab3196494168b8ff70852d59c71804847989bd235ed6f7

SHA512
c868f49e86de71858adcb8362ec03fe2e603bf4be088d6da8127fe44cf0c15b5cfbb33a970217edd2518a848d16a2d6a7cdf49d72b06949c87b281d2c404be23

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MpCmdRun.exe
Filesize
553KB

MD5
f2e5f64caba5341d1942bb7eb2287436

SHA1
c5b5091f98ee7affccd6209112cc4838fc4a1c6f

SHA256
1511c3b7230cf8cec1e9684a50de2034baa3e5e0c7be564989f279db3c90af53

SHA512
f9dde456e9abc240a30389e72913d69b8d5a7ead60fcf3c796b3872f0330b335005faf4d1adc742587761be56fafbabe5b6574cd7b544b38b09a0e7a22f37cdb

Download Submit
C:\Windows\SysWOW64\Zombie.exe
Filesize
129KB

MD5
b80193c2193c789821603b49dff8b9d3

SHA1
bcf4d048b668d75e532ef5f175f67c6248025c91

SHA256
0bc0090a8682c001f1155d4d84df233d54b3f6e32fc06dc054ad132b1398a2f6

SHA512
daee89fe4538f12be23de809700abeff1d086dccbf0b4d9fd9109a5a7b22bc962e09e11ca36951e3275ff2c2bf62380ca402a9df3c787025edc61e7d21281101

Download Submit
memory/1612-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1612-20-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads