3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe
Size

517KB
MD5

8914324d93a4f9cb2da1e664f88eb812
SHA1

6f38728cf4f08ff9caa35955ffc2aed73844a969
SHA256

3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d
SHA512

b545ffe63dcf5f2c8299778d67219672c67b3f72381f253407f645d8e40070d1b51b19f98c757dfdd7cab3d47bba59393187e1d9597390ab692c62d790c8dd71
SSDEEP

12288:iFF2Z0md3/94A2p8GnqZycIr+VtKzvFWOC3aEX90:iFF2Zx/WnSyhbzv8O0C

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1077) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 3 IoCs

pid	Process
2388	Zombie.exe
1588	_vcredist_x86.exe
4128	_vcredist_x86.exe

Loads dropped DLL 1 IoCs

pid	Process
4128	_vcredist_x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Net.WebSockets.Client.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Numerics.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\mscordaccore.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Runtime.Serialization.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\th-TH\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\Microsoft.NETCore.App.runtimeconfig.json.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.Pipes.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Intrinsics.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PresentationFramework.Classic.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Net.NameResolution.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Uri.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\fr\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Xml.XmlDocument.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-crt-process-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Security.Cryptography.Csp.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\PenImc_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ta.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msadox28.tlb.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Private.Xml.Linq.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.ServiceModel.Web.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\cs\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7z.sfx.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcer.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-processthreads-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\tr\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.Runtime.Serialization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\api-ms-win-core-debug-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\PresentationCore.resources.dll.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 2388	3248	3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe	91
PID 3248 wrote to memory of 2388	3248	3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe	91
PID 3248 wrote to memory of 2388	3248	3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe	91
PID 3248 wrote to memory of 1588	3248	3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe	92
PID 3248 wrote to memory of 1588	3248	3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe	92
PID 3248 wrote to memory of 1588	3248	3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe	92
PID 1588 wrote to memory of 4128	1588	_vcredist_x86.exe	93
PID 1588 wrote to memory of 4128	1588	_vcredist_x86.exe	93
PID 1588 wrote to memory of 4128	1588	_vcredist_x86.exe	93

C:\Users\Admin\AppData\Local\Temp\3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe
"C:\Users\Admin\AppData\Local\Temp\3c4faf1677a5c278ed6b34263b59f51124cd3d1195788067970c5bb955e34f6d.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2388
- C:\Users\Admin\AppData\Local\Temp\_vcredist_x86.exe
  "_vcredist_x86.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Users\Admin\AppData\Local\Temp\_vcredist_x86.exe
    "C:\Users\Admin\AppData\Local\Temp\_vcredist_x86.exe" -burn.unelevated BurnPipe.{9D74C6FF-9653-4BF8-AACA-B4EF8E5A5957} {1F48D0E3-3678-4515-A2D0-334218052972} 1588
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3808065738-1666277613-1125846146-1000\desktop.ini.exe

Filesize
73KB

MD5
6c4360a3f7d1484f9a1baa264cbbab68

SHA1
afbf1c1ea2cb237fb6a4bbee2e5e4a11a3c3d36e

SHA256
3ae34a4ce34c4e1b711122033ba3e42b75bada01d4fca1f0c60d272fef3a4a74

SHA512
eae29339f35eed6375e94db322aa945f7648bfe649611a1848bece174dbe58a447b5fd7d29cdb6701ea9f3e151f0943096bb658fd54726943867c77bad7bc95e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_vcredist_x86.exe

Filesize
443KB

MD5
39e2f79a5becdc5ffdf17003402c2f82

SHA1
7d2c053093cedf3e4b556628b3d8192275b983a8

SHA256
76583dd73769247f3ee4b1a74dfca1dd9792c74aaa246c324f97201c34ed1a5a

SHA512
2f4fba7ec629275f0cc64587d885ca9c1d8b5fb6e968b98b7307be93d6cf02a56871b8cc04990a3939ccb5b5840cf55b6a2f5093b3ee0c4d4cc72a996e6d343b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{95716cce-fc71-413f-8ad5-56c2892d4b3a}\.ba1\wixstdba.dll

Filesize
126KB

MD5
d7bf29763354eda154aad637017b5483

SHA1
dfa7d296bfeecde738ef4708aaabfebec6bc1e48

SHA256
7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93

SHA512
1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
73KB

MD5
31c8aafbfc4ecfe736869213bb61fe6e

SHA1
47e6d67b7d76ed67e2c069ae52bfb5b859dcd941

SHA256
52120cc0a65d259ebd547040eced5956e037e7b660dd42cd43809b68d2070507

SHA512
6ea49660e908315354cc9dc2fe32798254d78da0bfa98595c9d389acf88de2c596667e49b30b9ef6faba41a51ea9cd50f1aaa0c29dc96d029491aeea5a7c1b9e

Download Submit