Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-06-2024 23:07
Behavioral task
behavioral1
Sample
6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe
Resource
win10v2004-20240226-en
General
-
Target
6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe
-
Size
239KB
-
MD5
79f16bd2267886c88ca402c815ff44da
-
SHA1
55a9a4f672f3514f3e5dada2bdd01381384b7f1a
-
SHA256
6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f
-
SHA512
bc9ee10a21b6e55eefacca0a8d5335c4369c93013fcebe27974bd71ddf341b21b26cbd8c36539483453efa9bf47be15fb268d384b380956aac70f5f8decf8938
-
SSDEEP
3072:enaym3AIuZAIuyxJrQulAw9mHpKZNGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2S:wHm3AIuZAIuyxJrZ9UpK7ShcHUaZk
Malware Config
Signatures
-
Renames multiple (3497) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral1/memory/2228-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/files/0x000b00000001565d-5.dat UPX behavioral1/memory/2228-7-0x0000000000260000-0x000000000026B000-memory.dmp UPX behavioral1/memory/1100-19-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral1/files/0x0007000000015cff-21.dat UPX -
Executes dropped EXE 2 IoCs
pid Process 2392 _cinst.exe 1100 Zombie.exe -
Loads dropped DLL 3 IoCs
pid Process 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe -
resource yara_rule behavioral1/memory/2228-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x000b00000001565d-5.dat upx behavioral1/memory/2228-7-0x0000000000260000-0x000000000026B000-memory.dmp upx behavioral1/memory/1100-19-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0007000000015cff-21.dat upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Games\Purble Place\PurblePlace.dll.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\demux\libdiracsys_plugin.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\settings.js.tmp Zombie.exe File created C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh87.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\is.txt.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif.tmp Zombie.exe File created C:\Program Files\Java\jre7\bin\prism-d3d.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Hovd.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\RSSFeeds.css.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png.tmp Zombie.exe File created C:\Program Files\Internet Explorer\perfcore.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pontianak.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\sunmscapi.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Minsk.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp Zombie.exe File created C:\Program Files\Microsoft Games\FreeCell\de-DE\FreeCell.exe.mui.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\plugins\control\liboldrc_plugin.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\currency.css.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\nio.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Windows Journal\fr-FR\PDIALOG.exe.mui.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\currency.js.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\jaccess.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\sa-jdi.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-heapwalker.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Chisinau.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Mahjong\en-US\Mahjong.exe.mui.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.IdentityModel.Selectors.Resources.dll.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\lua\http\requests\status.json.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp Zombie.exe File created C:\Program Files\Java\jre7\bin\awt.dll.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Reunion.tmp Zombie.exe File created C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\highDpiImageSwap.js.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActionExceptionHandlers.exsd.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\libvlc.dll.tmp Zombie.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau.tmp Zombie.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2228 wrote to memory of 2392 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe 29 PID 2228 wrote to memory of 2392 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe 29 PID 2228 wrote to memory of 2392 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe 29 PID 2228 wrote to memory of 2392 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe 29 PID 2228 wrote to memory of 1100 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe 28 PID 2228 wrote to memory of 1100 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe 28 PID 2228 wrote to memory of 1100 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe 28 PID 2228 wrote to memory of 1100 2228 6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe"C:\Users\Admin\AppData\Local\Temp\6ad1912cbc7b771b829dc433db04aa8934b3c8ab429fc8891b344338dd01479f.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1100
-
-
C:\Users\Admin\AppData\Local\Temp\_cinst.exe"_cinst.exe"2⤵
- Executes dropped EXE
PID:2392
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5ca7c1c61a37eb9827395df5ba2e0fb1d
SHA1107b4f9d08b5696d7d58ede2ef41257687e7deb4
SHA256687bab215816a4a1b4eeaf1b629e024c4a38459aeaa830a14f60f43864c9bccf
SHA512997869337657b1ee496399c128b96c0262bfa4d8f6d2bd1d1d4e16fdca140d4500d04219fa3d4930aa9fb24e09a9e17aea993b8b2bd60d4cc8f0414977b2d48b
-
Filesize
143KB
MD52fdb371d45181dff59577110ba1064e2
SHA142a5833cb0ac90e38d734d1327bb3f7c7a6aa453
SHA25680d7ec8ce3913d81ea5d4f304b8609e56f0e49778c52af9279e742ea54f4a155
SHA51252982041ba9ca552b90b79b251501ec6c33c5251d09ca9969a1b179af2ec17aca6eb81db6e588e12751bcea04208e1da8d5a754a979dd98ceb3f50780aadea20
-
Filesize
96KB
MD55829fa8dc997f814aec5aab48c031cf2
SHA1bfcb09138d6f55824c5ccb1f3c3efa7c4b0ec180
SHA2567b61abab5027b6452db8e8405e64b902d9f83aa6f65854a7055f48daad8ef6b2
SHA512c61def35c728dadfbbf097cc0c06aa4f5de1663ad17003b0339c6d0d591cb1ef3adcf6eb9cf7555e5de3e0c942e514e55139dc1dee68084b399e7fdc3a782774