Analysis

  • max time kernel
    150s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/06/2024, 23:52

General

  • Target
    8de736b159b5edfe57b8a95791dd0f7bddb768cfa26bedc1edae7cccc13f300f.exe
  • Size 233KB
  • Sample240601-3w8desbd3y
  • SHA256 8de736b159b5edfe57b8a95791dd0f7bddb768cfa26bedc1edae7cccc13f300f
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10

Malware Config

Signatures

  • Renames multiple (4748) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 60 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 61 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8de736b159b5edfe57b8a95791dd0f7bddb768cfa26bedc1edae7cccc13f300f.exe
    "C:\Users\Admin\AppData\Local\Temp\8de736b159b5edfe57b8a95791dd0f7bddb768cfa26bedc1edae7cccc13f300f.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1012
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:4540
    • C:\Users\Admin\AppData\Local\Temp\_KB3033929.nupkg.exe
      "_KB3033929.nupkg.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:3076

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        desktop.ini.tmp

        • Path C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
        • Size 121KB
        • SHA256 49025804a2bc04387427f1a95dc490cb33ff422fdee438787cf414159e9f0bed
        • MD5 SHA1 SHA512 SSDEEP

        7-zip.chm.tmp

        • Path C:\Program Files\7-Zip\7-zip.chm.tmp
        • Size 224KB
        • SHA256 6520862a47a31646165ce0b53f15ecd9823a95c225b4b1d37ef74d4901ca4cbb
        • MD5 SHA1 SHA512 SSDEEP

        7z.dll.tmp

        • Path C:\Program Files\7-Zip\7z.dll.tmp
        • Size 1.9MB
        • SHA256 28abf327cecde740d7e779163ab05da913ea2de05b7150fe52bf0936ba842f51
        • MD5 SHA1 SHA512 SSDEEP

        7z.exe.tmp

        • Path C:\Program Files\7-Zip\7z.exe.tmp
        • Size 488KB
        • SHA256 6b28b23833914ddfd28f0e49e686a4ab487fbacc689f39d8fb519a65d4b21569
        • MD5 SHA1 SHA512 SSDEEP

        7z.sfx.tmp

        • Path C:\Program Files\7-Zip\7z.sfx.tmp
        • Size 331KB
        • SHA256 724b9895d3989c29d9e8de4f33611d829a176bcb0f3be8e3103ac3822fe17888
        • MD5 SHA1 SHA512 SSDEEP

        7zCon.sfx.tmp

        • Path C:\Program Files\7-Zip\7zCon.sfx.tmp
        • Size 310KB
        • SHA256 c21fc29d8032affc2495cb46f188e61c8570b2e8bdca80766022b29142e178c1
        • MD5 SHA1 SHA512 SSDEEP

        7zG.exe.tmp

        • Path C:\Program Files\7-Zip\7zG.exe.tmp
        • Size 805KB
        • SHA256 96c2f6bf26c2507647172ab866b773f471bcf31c1b7436789ae6b43968c4f6c3
        • MD5 SHA1 SHA512 SSDEEP

        af.txt.exe

        • Path C:\Program Files\7-Zip\Lang\af.txt.exe
        • Size 131KB
        • SHA256 58dacecddb77c8e55ed7dba92f6767eb5227bd0b261215a5701044ca6176d8a0
        • MD5 SHA1 SHA512 SSDEEP

        ba.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ba.txt.tmp
        • Size 112KB
        • SHA256 ec198b84fb9b42ce7b3e379c900f1aa1c3798a1a75e91812c4e5b3fdb5ed49e1
        • MD5 SHA1 SHA512 SSDEEP

        bn.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\bn.txt.tmp
        • Size 136KB
        • SHA256 81b010ddd2de11e9d97148c14fe496d21c1350603db76c95c5a9dea357745d97
        • MD5 SHA1 SHA512 SSDEEP

        br.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\br.txt.tmp
        • Size 126KB
        • SHA256 f950945acb31ba9f35199b44e4025a2d862462517842f5d9f74ec23e482788d5
        • MD5 SHA1 SHA512 SSDEEP

        ca.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ca.txt.tmp
        • Size 130KB
        • SHA256 6f8baf76898a524c5c2ce0b8e643f8f2df1c63d5d292999eb0436261c47410d5
        • MD5 SHA1 SHA512 SSDEEP

        co.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\co.txt.tmp
        • Size 132KB
        • SHA256 f05f24e624c197d80d8e3a7cfa0c96a5799fadbd2470201e1054a3e455a7b22d
        • MD5 SHA1 SHA512 SSDEEP

        cy.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\cy.txt.tmp
        • Size 126KB
        • SHA256 2dfb5955dfc821235623013481dc1132f604e29425b51b480ae12aaba791d41f
        • MD5 SHA1 SHA512 SSDEEP

        da.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\da.txt.tmp
        • Size 112KB
        • SHA256 df434a32ae34c076166f284539d89591966160209df6efd463a5b1130dad1841
        • MD5 SHA1 SHA512 SSDEEP

        es.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\es.txt.tmp
        • Size 131KB
        • SHA256 b62f72eefa443da2a1b4551b9e7f6b3bf51aaf4b9b507279da1e9084429a2a34
        • MD5 SHA1 SHA512 SSDEEP

        et.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\et.txt.tmp
        • Size 128KB
        • SHA256 01ba35e64879cec633c1719575095e94ada443d13a078a2813da9a52fcc521f4
        • MD5 SHA1 SHA512 SSDEEP

        eu.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\eu.txt.tmp
        • Size 130KB
        • SHA256 7b5961ab962003a5cf9b1cb2f163aa30349e5d5445cabe94cb20ddfa3fda9c11
        • MD5 SHA1 SHA512 SSDEEP

        ext.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ext.txt.tmp
        • Size 129KB
        • SHA256 a90dd56fd8756bc976d6ee27374ad4ad4666e725b235e4a05332e3e03b9150b3
        • MD5 SHA1 SHA512 SSDEEP

        fa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fa.txt.tmp
        • Size 134KB
        • SHA256 da525b1f367a4d54d3aa3b2e515067d75cb714001635552b2547778790535e36
        • MD5 SHA1 SHA512 SSDEEP

        fr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fr.txt.tmp
        • Size 121KB
        • SHA256 c8aabe71d8d2a576488e13a417fe3d00685b836f49f488ef2dfed719d8189110
        • MD5 SHA1 SHA512 SSDEEP

        fy.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fy.txt.tmp
        • Size 121KB
        • SHA256 6c8d6d71e660ba87ddacdb1f37f5fb0abe2af6f3115d137c153bc8a37cfb7eec
        • MD5 SHA1 SHA512 SSDEEP

        ga.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ga.txt.tmp
        • Size 121KB
        • SHA256 2f004f3844342088afbf5dd93beecada2cfb1a14b9f94a6c365a8d4c5026e62f
        • MD5 SHA1 SHA512 SSDEEP

        gl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\gl.txt.tmp
        • Size 121KB
        • SHA256 c249fc6ba7de37fb3f0886e13604e7aceaa8d8eaa6a47c38e0f5579b363ce3ca
        • MD5 SHA1 SHA512 SSDEEP

        he.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\he.txt.tmp
        • Size 123KB
        • SHA256 4d03ab61224f1399f26a6891cb3d8dce9f3ec58858e8335789b06e1be3dd35eb
        • MD5 SHA1 SHA512 SSDEEP

        hi.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hi.txt.tmp
        • Size 138KB
        • SHA256 cef47b56be6c8575b4da3393befbf1cc25fe1d59dce4c4e0481b2341f1d0b9a4
        • MD5 SHA1 SHA512 SSDEEP

        hu.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hu.txt.tmp
        • Size 131KB
        • SHA256 8987cfeca97eadc491cad4d5af99ad41dc7f9cfc3e0024738d749a32b117e505
        • MD5 SHA1 SHA512 SSDEEP

        hy.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hy.txt.tmp
        • Size 135KB
        • SHA256 5e307ebbf22d9b21b9b40ce7f0167d09270e8e46fa3bb2e81920654629f369f9
        • MD5 SHA1 SHA512 SSDEEP

        id.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\id.txt.tmp
        • Size 129KB
        • SHA256 bf80d7cc13219ac529ea3a2fbf9d7c47cc7118710ae52c808737c561f3d49570
        • MD5 SHA1 SHA512 SSDEEP

        ja.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ja.txt.tmp
        • Size 133KB
        • SHA256 ca9e32dacd2abdb8c0b18effe21a2711168dce42414ddc381718d0dfab52c713
        • MD5 SHA1 SHA512 SSDEEP

        ka.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ka.txt.tmp
        • Size 139KB
        • SHA256 a3285084a9552c5ca31743cdff593e538c6797a100d40f39644a24d01c9a4238
        • MD5 SHA1 SHA512 SSDEEP

        kk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\kk.txt.tmp
        • Size 131KB
        • SHA256 aa92ff84aa4dea1acbdbb38ea98efb8701104b758ad661d74618e3fb2e4045ae
        • MD5 SHA1 SHA512 SSDEEP

        ko.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ko.txt.tmp
        • Size 131KB
        • SHA256 65612269f08f32cb78c81d5ec84e7ab9bb9af46ecaeeaf2804529f8d4c0a94f7
        • MD5 SHA1 SHA512 SSDEEP

        ku-ckb.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp
        • Size 133KB
        • SHA256 ac8438d38605a237bf97da149187b4ad16f9511169fd982249bec7c1bbbe2365
        • MD5 SHA1 SHA512 SSDEEP

        ky.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ky.txt.tmp
        • Size 133KB
        • SHA256 d06e3f1af4c8b89114384922cc59d5323d561163810a7eb29bea8f914a496438
        • MD5 SHA1 SHA512 SSDEEP

        lij.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\lij.txt.tmp
        • Size 129KB
        • SHA256 9567f50a484f53e4c771ec3e341711f032affeae27505c15a09d5cd78e77f02b
        • MD5 SHA1 SHA512 SSDEEP

        lt.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\lt.txt.tmp
        • Size 130KB
        • SHA256 f6217af3fa634cda581abe9d60a13f88450b8927e3a911ee5a49c0341b21976e
        • MD5 SHA1 SHA512 SSDEEP

        lv.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\lv.txt.tmp
        • Size 112KB
        • SHA256 8faac463a21e2ea043544bb27c1bbf7a1958d07fde0642a80de5533d4761e2d5
        • MD5 SHA1 SHA512 SSDEEP

        mk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mk.txt.tmp
        • Size 130KB
        • SHA256 55ba134f756d596bd49b19f79fbf33ed09ca6f0ff122a06270892eea6a240bd3
        • MD5 SHA1 SHA512 SSDEEP

        mng.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mng.txt.tmp
        • Size 141KB
        • SHA256 abc0d8b7cfa2994512e133d3698c47fdefd37a91b05672d855069b91fa93c5e8
        • MD5 SHA1 SHA512 SSDEEP

        mng2.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mng2.txt.tmp
        • Size 142KB
        • SHA256 07524d4388729ad534bf36b15b6dddabdb5fdc4c82aeccb89269c42991cc5630
        • MD5 SHA1 SHA512 SSDEEP

        mr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mr.txt.tmp
        • Size 132KB
        • SHA256 cbb2c1c25ab9e1315a9cb8cbc44b5974c95ce7537a51d2c11bd10d4772cab6d7
        • MD5 SHA1 SHA512 SSDEEP

        ms.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ms.txt.tmp
        • Size 121KB
        • SHA256 08fba45dfacd3607a9b23b6cccab6bcc3f69c072ce6cc47acbd1d17fea6da7b4
        • MD5 SHA1 SHA512 SSDEEP

        nb.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\nb.txt.tmp
        • Size 127KB
        • SHA256 806da5a3bf71f59353f48cf5aac166de726322d5b04b570623b8cd2fb64162cc
        • MD5 SHA1 SHA512 SSDEEP

        ne.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ne.txt.tmp
        • Size 125KB
        • SHA256 99905bd0719acbb97863a8e2254f461ae7d33f30597e62f6686b17aecd67e042
        • MD5 SHA1 SHA512 SSDEEP

        pa-in.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\pa-in.txt.tmp
        • Size 126KB
        • SHA256 ca9f803e6fa98146e75e092ee0980357d8966e6f6a7808809ee77bdb16e38d8e
        • MD5 SHA1 SHA512 SSDEEP

        pl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\pl.txt.tmp
        • Size 121KB
        • SHA256 5ed8b203b40b71840d4152408e1bcd995e46c53c64f451affae1959cabd195ae
        • MD5 SHA1 SHA512 SSDEEP

        ps.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ps.txt.tmp
        • Size 121KB
        • SHA256 4cbe9963f6b7cffc4ace661b8f02390937592aed14dee46ed6c49939eb87f4e7
        • MD5 SHA1 SHA512 SSDEEP

        ro.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ro.txt.tmp
        • Size 128KB
        • SHA256 2fae8b51872ab8a36a8dac6ceab838b902730d8361a636869090a6431079277d
        • MD5 SHA1 SHA512 SSDEEP

        ru.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ru.txt.tmp
        • Size 136KB
        • SHA256 ce5f086c5b39dc9e3739967e5866d99aa04a390f7e67147d5a741e0065e1b8c2
        • MD5 SHA1 SHA512 SSDEEP

        sa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sa.txt.tmp
        • Size 130KB
        • SHA256 e7c1e126a19f8bc858e9f4686d327955f37ead26abb7dc310fce79475e9212d8
        • MD5 SHA1 SHA512 SSDEEP

        sl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sl.txt.tmp
        • Size 120KB
        • SHA256 4aaa50856f9bb1e70e5216991090501e71ac59e8ae2fcd671b9cc49ac337b90f
        • MD5 SHA1 SHA512 SSDEEP

        sr-spc.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp
        • Size 133KB
        • SHA256 687098be0d5e5dd5559601a5bc4f084cbc3f8bb56b74f61851a7899d71adf990
        • MD5 SHA1 SHA512 SSDEEP

        sr-spl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp
        • Size 121KB
        • SHA256 324cd76877652e660447852d0acea76cc39c314720d4a65db063c8392e762c1e
        • MD5 SHA1 SHA512 SSDEEP

        sw.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sw.txt.tmp
        • Size 121KB
        • SHA256 784ea4c6197000727ed3f1c98fd1983b9262226adaf832417423ae1b590e11b3
        • MD5 SHA1 SHA512 SSDEEP

        descript.ion.tmp

        • Path C:\Program Files\7-Zip\descript.ion.tmp
        • Size 121KB
        • SHA256 369c3b8516f80a65d75135f6f83434de3b009d82ece74097aad6f2f5de153b92
        • MD5 SHA1 SHA512 SSDEEP

        freebxml.md.tmp

        • Path C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md.tmp
        • Size 121KB
        • SHA256 9aa066deb059019b374cfbb1818176d0170d013bde9cc5f3f751a3125b34de50
        • MD5 SHA1 SHA512 SSDEEP

        _KB3033929.nupkg.exe

        • Path C:\Users\Admin\AppData\Local\Temp\_KB3033929.nupkg.exe
        • Size 121KB
        • SHA256 229f9b2800345cc8aa727e7c48d2786ff27a9204950f22367a817257e2d767d9
        • MD5 SHA1 SHA512 SSDEEP

        Zombie.exe

        • Path C:\Windows\SysWOW64\Zombie.exe
        • Size 112KB
        • SHA256 6f8b125cbc08d35e9a873d11ceb0598a6bb39af2aaa4871d5f91531e78c5417f
        • MD5 SHA1 SHA512 SSDEEP

        memory/1012-0-0x0000000000400000-0x000000000040A000-memory.dmp

        memory/3076-10-0x0000000000400000-0x000000000040A000-memory.dmp