Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe
- Size 105KB
- Sample240530-2wp2eadh48
- SHA256 69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f
- MD5 6db89394428f0d463bdcbd9626cd05c1
- SHA1 371a7b3c78fe77153612445cd9ec0d27d63b348c
- SHA512 c794fd01ff814c0f0b844da0ead0af0ae581fb3668c146e1a654b3e530fc3b799401973d22fe99f446028358bb293d3d3c88e986ab28d70309f01608a27898a7
- SSDEEP 3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBx:PqFF2Ie+efZm
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5037) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 4524 Zombie.exe 1280 _checksum.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\README.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DLL.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Requests.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019MSDNR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.LEX.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_MAK_AE-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\it.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Extensions.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\deploy.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019DemoR_BypassTrial180-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f4\FA000000005.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHLTS.DLL.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PPSLAX.DLL.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.TypeExtensions.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WORD_WHATSNEW.XML.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXT.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\nl.pak.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\vcruntime140.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_ConsumerSub_Bypass30-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.bundle.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\uz.txt.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libcrypto-1_1-x64.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-fibers-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-file-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\santuario.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\TipRes.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial3-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp Zombie.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2364 wrote to memory of 4524 2364 69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe 90 PID 2364 wrote to memory of 1280 2364 69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe 91 PID 2364 wrote to memory of 4524 2364 69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe 90 PID 2364 wrote to memory of 4524 2364 69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe 90 PID 2364 wrote to memory of 1280 2364 69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe"C:\Users\Admin\AppData\Local\Temp\69637b04489b9aa5920067fef6053d1803e639ebe119b19f731cdc9be79a401f.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4524
-
-
C:\Users\Admin\AppData\Local\Temp\_checksum.exe"_checksum.exe"2⤵
- Executes dropped EXE
PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4256,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:81⤵PID:4548
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.exe
- Size 68KB
- SHA256 94865e70db7083ef2cc2f033618998ef252541790a87bfcd6c24e752dd908807
- MD5 0f0014cfff063c53df9df4f8eed67023
- SHA1 8055325f15e36319cb390fee49d147877f3ea593
- SHA512 d6dea760c567e05de6264041768438ca004ea1d1a3189fdbad3cf437d93e415473de20e102e6875bfda8937458bc70be533c7f4bb1fdc15200b04c7f6877b440
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEhQ:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsR
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_checksum.exe
- Size 37KB
- SHA256 b5481e424246a174456add0132427df3a7cd4105f5769835cdf597966c7c0b61
- MD5 371627fd939bb54ed26f473ca54e718f
- SHA1 3a6910295ae9d1fe388b7572736b8bdfc6e0d111
- SHA512 ff7ea5ae445089ffa808c97e23c620313dd267994b343176c0cb9f8098aace1d12d9212b96611fdf97c974ef94f866b817aed9c0e5f4f195234e7d8d4ec3f8cd
- SSDEEP 768:c2aUriLtuRZFwdpyTmNSHSBLVogO6QlRSO/SDGEEPxWEC4:dr0ARZF6NFVogjQlRv/NPxv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 68KB
- SHA256 6ff868e88ec60d95a5f781aaf4a6b6d2832066b06c9c083ecbe3734906ce79b0
- MD5 43baf4e8cf8522c1839e99c83af5eaed
- SHA1 d9a9d81729e82b2d964e0d8d2da2ca26ad1df401
- SHA512 217e572f90b1a6e1130d0c78431fb4ffd335875b6f0f00dc610e2787e669329822922c4b2d375eddf56a2de0d29cadf8a879e456580ba3112f5866a25d79a6a5
- SSDEEP 1536:W7ZppApUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFsAcEh4:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsJ
- MD5 SHA1 SHA512 SSDEEP