bbdd38fcf1e08fbf17a53db96b45369b32748a2713c8ad9f18f1913b82d951d3

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbdd38fcf1e08fbf17a53db96b45369b32748a2713c8ad9f18f1913b82d951d3.exe
Size

96KB
MD5

a6c84e47bba33813a97f6bbb5dcc8e71
SHA1

0e0a26f8bdf1113c6da38874448886d9a33a8e6c
SHA256

bbdd38fcf1e08fbf17a53db96b45369b32748a2713c8ad9f18f1913b82d951d3
SHA512

881aef4d81e5bae13b915aa16c578b058210df1338741dd8c1134e3324a01fd8610843f255a16845e1c2bc58dcad1328b04f81c877cadec22aa8d5006dc1ca5c
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfo:hfAIuZAIuYSMjoqtMHfhfo

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1580) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/2104-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000f000000023249-7.dat	UPX
behavioral2/files/0x0007000000023259-11.dat	UPX
behavioral2/memory/2104-20-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
4168	Zombie.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2104-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000f000000023249-7.dat	upx
behavioral2/files/0x0007000000023259-11.dat	upx
behavioral2/memory/2104-20-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	bbdd38fcf1e08fbf17a53db96b45369b32748a2713c8ad9f18f1913b82d951d3.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	bbdd38fcf1e08fbf17a53db96b45369b32748a2713c8ad9f18f1913b82d951d3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-interlocked-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework-SystemDrawing.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ComponentModel.TypeConverter.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_elf.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-private-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.DiaSymReader.Native.amd64.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\vk_swiftshader.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-processthreads-l1-1-1.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-util-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.IO.FileSystem.DriveInfo.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\hostpolicy.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.Security.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\PresentationFramework.AeroLite.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-heap-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msdaremr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.Tracing.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ja\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Formats.Asn1.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscorrc.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipresx.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Diagnostics.TextWriterTraceListener.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\javafx-src.zip.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Globalization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XPath.XDocument.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.Linq.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\eventlog_provider.dll.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\es-ES\ieinstal.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Collections.Concurrent.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Windows.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\System.Security.Cryptography.ProtectedData.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 4168	2104	bbdd38fcf1e08fbf17a53db96b45369b32748a2713c8ad9f18f1913b82d951d3.exe	90
PID 2104 wrote to memory of 4168	2104	bbdd38fcf1e08fbf17a53db96b45369b32748a2713c8ad9f18f1913b82d951d3.exe	90
PID 2104 wrote to memory of 4168	2104	bbdd38fcf1e08fbf17a53db96b45369b32748a2713c8ad9f18f1913b82d951d3.exe	90

C:\Users\Admin\AppData\Local\Temp\bbdd38fcf1e08fbf17a53db96b45369b32748a2713c8ad9f18f1913b82d951d3.exe
"C:\Users\Admin\AppData\Local\Temp\bbdd38fcf1e08fbf17a53db96b45369b32748a2713c8ad9f18f1913b82d951d3.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5024 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.exe

Filesize
96KB

MD5
2bac71fe613977c04dc8ff0ef30888b6

SHA1
9d65f06d929089bcb16c2852450f1a0386817108

SHA256
2d0756c2bdf4cd33b75015722018654ec02e4e5d3aceef4a6f17ca16ffc358d3

SHA512
5de6c1fc35e0b2b656db2c3f9269239ce9681e11c9117f3968b93e165ed8eca89bcc22d9cfcb255e0a2493e9edd2b26419028858b279f0adf1ff0224ba44faba

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
96KB

MD5
14db7f7f9cc0fce98acc41391fa3585a

SHA1
4d2ee614bd71c6d3b848c6437643bd1aeaf357cc

SHA256
327ab8eb5caf70cfbbdd38b989e9fa97601fd7a156bb66d23ee7d976ac65b467

SHA512
d58e0343b13cedab4a753397f87df09880b240938299d53419ccf301b09aa351d5d69f1836ae24331fdbff13c0379e70ccbc8417e0bc42954f07e3110acf17fe

Download Submit
memory/2104-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2104-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download