Analysis

  • max time kernel
    149s
  • max time network
    55s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 00:23

General

  • Target
    8a3d12ea4f19d8ba71407adf6f92a840a3da4bd6445516505a497058896d7182.exe
  • Size 118KB
  • Sample240611-apfqlswfrf
  • SHA256 8a3d12ea4f19d8ba71407adf6f92a840a3da4bd6445516505a497058896d7182
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10

Malware Config

Signatures

  • Renames multiple (5352) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • UPX dump on OEP (original entry point) 62 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 62 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8a3d12ea4f19d8ba71407adf6f92a840a3da4bd6445516505a497058896d7182.exe
    "C:\Users\Admin\AppData\Local\Temp\8a3d12ea4f19d8ba71407adf6f92a840a3da4bd6445516505a497058896d7182.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1520
    • C:\Users\Admin\AppData\Local\Temp\_.files.exe
      "_.files.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:3464
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:4652

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        desktop.ini.tmp

        • Path C:\$Recycle.Bin\S-1-5-21-2539840389-1261165778-1087677076-1000\desktop.ini.tmp
        • Size 60KB
        • SHA256 86312fe97274c42ad536d51e9fac7a225dcd34083742561805314ae44f3f5abf
        • MD5 SHA1 SHA512 SSDEEP

        7-zip.chm.exe

        • Path C:\Program Files\7-Zip\7-zip.chm.exe
        • Size 172KB
        • SHA256 9d3c02315ebbd2b25561a792d1b4d88f0ce5b862ef91e20ca4abbccbe831b881
        • MD5 SHA1 SHA512 SSDEEP

        7-zip.dll.exe

        • Path C:\Program Files\7-Zip\7-zip.dll.exe
        • Size 159KB
        • SHA256 d5225cc9540d254350fdd4d8c39728f8651975156e7c66d2c18cc757c81180d6
        • MD5 SHA1 SHA512 SSDEEP

        7z.dll.tmp

        • Path C:\Program Files\7-Zip\7z.dll.tmp
        • Size 1.2MB
        • SHA256 c52503fcbd80c59646deb8d677796c2329e62e9aa3d2ff4e190c2c6046909726
        • MD5 SHA1 SHA512 SSDEEP

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 604KB
        • SHA256 110851fa7028874f1e8db4fb9e52274dc0242c7f9a582a51d31f1fa6f3761902
        • MD5 SHA1 SHA512 SSDEEP

        7z.sfx.tmp

        • Path C:\Program Files\7-Zip\7z.sfx.tmp
        • Size 268KB
        • SHA256 437fab1b4c8de1003de3385fe76523021a40216c4355e360d88fed5d8c444b25
        • MD5 SHA1 SHA512 SSDEEP

        7zFM.exe.tmp

        • Path C:\Program Files\7-Zip\7zFM.exe.tmp
        • Size 990KB
        • SHA256 d3655a3ff69e3e3311395209d907523e1a97635e1ef3fcb476a3d64534333a2e
        • MD5 SHA1 SHA512 SSDEEP

        7zG.exe.tmp

        • Path C:\Program Files\7-Zip\7zG.exe.tmp
        • Size 744KB
        • SHA256 caabcca66f30669d61656e9b2d2cd51dd7aafcfc6b853dcb4709f6ca6913ad06
        • MD5 SHA1 SHA512 SSDEEP

        History.txt.tmp

        • Path C:\Program Files\7-Zip\History.txt.tmp
        • Size 116KB
        • SHA256 a6a4318c585a2e038003316aef20d63f15f0577666610cbf473e6cac5aabecd2
        • MD5 SHA1 SHA512 SSDEEP

        af.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\af.txt.tmp
        • Size 68KB
        • SHA256 804ea4dcc2ca9f19283a5ba480c48ad408a0e8f639166d44a058fbf064b97694
        • MD5 SHA1 SHA512 SSDEEP

        ar.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ar.txt.tmp
        • Size 72KB
        • SHA256 47eb0936d0496804f9ae2b5c5b46d72ee2c2871f76b183bc09d7bc0fda14ad67
        • MD5 SHA1 SHA512 SSDEEP

        ba.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ba.txt.tmp
        • Size 69KB
        • SHA256 c26b577feba08cba07c8479dd372d47527db9d814344fc7a3ff63624238c517b
        • MD5 SHA1 SHA512 SSDEEP

        bg.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\bg.txt.tmp
        • Size 72KB
        • SHA256 a861aa83bb65a7374450bf7158533a4ce45a65653ecf7950a4b770f0250b243e
        • MD5 SHA1 SHA512 SSDEEP

        bn.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\bn.txt.tmp
        • Size 74KB
        • SHA256 9af8f50a1a7852f1759b037874b54ab2f5e8aa4ebef330f997cfa2a29c9b4be7
        • MD5 SHA1 SHA512 SSDEEP

        br.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\br.txt.tmp
        • Size 65KB
        • SHA256 c6e5cfd2136736067b59d2ea719fa2e2199a7e8cad786894ea75424adbace5a8
        • MD5 SHA1 SHA512 SSDEEP

        ca.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ca.txt.tmp
        • Size 67KB
        • SHA256 f83cca574a555b1d4b4f5954bc4f071342f5dae520543b982861888d45eb1f6a
        • MD5 SHA1 SHA512 SSDEEP

        cs.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\cs.txt.tmp
        • Size 68KB
        • SHA256 052ad64fd27a83e604c18aa136ec63b8f40406c33a749df048c1a1cd646e25d3
        • MD5 SHA1 SHA512 SSDEEP

        cy.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\cy.txt.tmp
        • Size 63KB
        • SHA256 69ce85c9f7d99def5beca08dad013bb6fe66921558c45a8b18e4581bb450f11c
        • MD5 SHA1 SHA512 SSDEEP

        da.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\da.txt.tmp
        • Size 66KB
        • SHA256 d06ed8f6a5b25be5172ac81487eb4260873fd9e41c29bb980a661a4dd0c33e37
        • MD5 SHA1 SHA512 SSDEEP

        el.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\el.txt.tmp
        • Size 75KB
        • SHA256 5fd6d8c75cd492f66f212d1c9ee715b16df6f62d52e139f986c0badc47269b9d
        • MD5 SHA1 SHA512 SSDEEP

        es.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\es.txt.tmp
        • Size 68KB
        • SHA256 8b3c0e1b5d40de503280b3256c721aeb622228852baa9f0e58684d5eca6fa790
        • MD5 SHA1 SHA512 SSDEEP

        fa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fa.txt.tmp
        • Size 73KB
        • SHA256 2c69c2ad6e4f2655809a07065484c3383719241b98d22207cc7496a34a8eba75
        • MD5 SHA1 SHA512 SSDEEP

        fi.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fi.txt.tmp
        • Size 68KB
        • SHA256 ed7a64224a1725fbe7205282582e5163c698d04d26b69fdabac860f3155d8167
        • MD5 SHA1 SHA512 SSDEEP

        fr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fr.txt.tmp
        • Size 69KB
        • SHA256 3e1d8936339a04166ae3ee187c3a0a8c0f90917bb36bc12529977c22676310ef
        • MD5 SHA1 SHA512 SSDEEP

        fur.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fur.txt.tmp
        • Size 67KB
        • SHA256 a8640c7761b107d36c49c9371835e5f070d26db8b58335976b15bfc2754ecafa
        • MD5 SHA1 SHA512 SSDEEP

        ga.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ga.txt.tmp
        • Size 68KB
        • SHA256 bcebd016a865eb4d3f346d277a7712ebb0d4ca0e15f7b87dcf092c6756ade1cd
        • MD5 SHA1 SHA512 SSDEEP

        gu.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\gu.txt.tmp
        • Size 75KB
        • SHA256 0a342083a0f8a58b27603fddf19a610d540301fba68f012a5073c8b55c6fa81f
        • MD5 SHA1 SHA512 SSDEEP

        hi.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hi.txt.tmp
        • Size 77KB
        • SHA256 b7a1760a0be5991a31960fe22fae62c3cafc3fe27130f152aafb7554abd4b6e2
        • MD5 SHA1 SHA512 SSDEEP

        hr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hr.txt.tmp
        • Size 68KB
        • SHA256 eda882a440641ac6845f16f51e5199f362bb4e575eca6fa03b77d8db3a8a3816
        • MD5 SHA1 SHA512 SSDEEP

        id.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\id.txt.tmp
        • Size 68KB
        • SHA256 9382cb8514afbe9209f97e08905669715533cf5010e2934cb5688ec6fb5820d2
        • MD5 SHA1 SHA512 SSDEEP

        io.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\io.txt.tmp
        • Size 69KB
        • SHA256 dd981f35410366ca253f44fd7278b3013783589b54dcc12d896c6d4fbe56a1d4
        • MD5 SHA1 SHA512 SSDEEP

        is.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\is.txt.tmp
        • Size 68KB
        • SHA256 2682522eb98fe8a5857b03c396f84f53409168393b33249ff2c9fa0eafceb9e4
        • MD5 SHA1 SHA512 SSDEEP

        it.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\it.txt.tmp
        • Size 68KB
        • SHA256 035d01f8cf0d9ae0b69db969571c763b1b3ae1accbc401f82c4a28ef97747d6a
        • MD5 SHA1 SHA512 SSDEEP

        ja.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ja.txt.tmp
        • Size 71KB
        • SHA256 4e35be65274ef10c010ad8efa754c20b57633d0ac16416453982ee15139283f6
        • MD5 SHA1 SHA512 SSDEEP

        ka.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ka.txt.tmp
        • Size 77KB
        • SHA256 f4d84532b60e2fb29aaaa348881393c9e60c6b75a25be194a5e60606638c2c7f
        • MD5 SHA1 SHA512 SSDEEP

        kaa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\kaa.txt.tmp
        • Size 67KB
        • SHA256 04fe8b87d0a0bde4c94183fa40297917e4098d01170184db15f535bda56673d7
        • MD5 SHA1 SHA512 SSDEEP

        kab.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\kab.txt.tmp
        • Size 68KB
        • SHA256 af476e14f91c24da3fc2e0bdd04cc8e5e70bb7f9845b7d6bc6d6af15627ee960
        • MD5 SHA1 SHA512 SSDEEP

        ko.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ko.txt.tmp
        • Size 68KB
        • SHA256 915a8334936120901eda73d35fd0f439b4a7f0de0ecf493146ebcc1e11fa1d77
        • MD5 SHA1 SHA512 SSDEEP

        ku-ckb.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp
        • Size 72KB
        • SHA256 367d70e7a240d0a5684950b1071b9201de8a15f844b3e287bc2b39a80ef928ab
        • MD5 SHA1 SHA512 SSDEEP

        ku.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ku.txt.tmp
        • Size 64KB
        • SHA256 1cf2964bf8fd36d87855076df71488031c72f09a770819dd02c60157650ec7de
        • MD5 SHA1 SHA512 SSDEEP

        lij.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\lij.txt.tmp
        • Size 67KB
        • SHA256 09ae5fb6b09e9e81e66e06c76a9da942d739a4280fca32cbf55380c77a3a4588
        • MD5 SHA1 SHA512 SSDEEP

        mk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mk.txt.tmp
        • Size 68KB
        • SHA256 02d67f19c8594ba04e2f5af4cca341ec0cedac7d90706129ab4009dabbf0a946
        • MD5 SHA1 SHA512 SSDEEP

        mn.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mn.txt.tmp
        • Size 68KB
        • SHA256 0b3c2c098018fb60d25a2f4369fe95706d32e9a1223d7f0f39e4791cc31c53d8
        • MD5 SHA1 SHA512 SSDEEP

        mng2.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mng2.txt.tmp
        • Size 79KB
        • SHA256 7589feb52f20b17a206c8c995eac9cacd943aa9d4617cda661c535b4419de67c
        • MD5 SHA1 SHA512 SSDEEP

        mr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mr.txt.tmp
        • Size 70KB
        • SHA256 b33492cbe8bf270c9adcc14111cd89b3ef882b207ad42d9dfbfe3058e4f4597c
        • MD5 SHA1 SHA512 SSDEEP

        ms.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ms.txt.tmp
        • Size 65KB
        • SHA256 7317fd75becbdf5c21af8775be17961d0422840be2689f17a223eca819ad15bb
        • MD5 SHA1 SHA512 SSDEEP

        ms.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ms.txt.tmp
        • Size 65KB
        • SHA256 fe5f18ee6e531788c59b0b96f522655b833a3a35afce91db3d42adeba9efc044
        • MD5 SHA1 SHA512 SSDEEP

        ne.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ne.txt.tmp
        • Size 71KB
        • SHA256 ad6c5170f5bd69bccd784b730c55dcf6963451b4600563e52619529fa3ed0fb4
        • MD5 SHA1 SHA512 SSDEEP

        nn.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\nn.txt.tmp
        • Size 64KB
        • SHA256 37e39c35f2b05dff2be6845cbb82cb1f9aaef67d28c6c3fe34ae20599a033612
        • MD5 SHA1 SHA512 SSDEEP

        pl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\pl.txt.tmp
        • Size 68KB
        • SHA256 9b90c81b0a0aae6122fe2116bf6389bfd4209c758e2b9b5f2b870b6f080bd64c
        • MD5 SHA1 SHA512 SSDEEP

        ru.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ru.txt.tmp
        • Size 73KB
        • SHA256 4e2b1477b371e8eaf4b9b301529df725ae35ff8ba8a9d2c3bd8bf852448bde7a
        • MD5 SHA1 SHA512 SSDEEP

        sa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sa.txt.tmp
        • Size 60KB
        • SHA256 67e7af71888ab520c20497a7757e6cd5c8bda1c1038cdcf9a9c9c5983d198dca
        • MD5 SHA1 SHA512 SSDEEP

        si.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\si.txt.tmp
        • Size 78KB
        • SHA256 547af4e2328e1a766371ca5c7e5cee27c2c29112a1c2ffc4331942e54f83668f
        • MD5 SHA1 SHA512 SSDEEP

        sk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sk.txt.tmp
        • Size 67KB
        • SHA256 cfce1a7580951b8e152cdb9c5fb6074790465fa03ae3260df1a45bc9a2baeefa
        • MD5 SHA1 SHA512 SSDEEP

        sl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sl.txt.tmp
        • Size 60KB
        • SHA256 73d2c60d0b7e93c64d5748c055202c0776890cbaa59a24eb3829bff75dd65e94
        • MD5 SHA1 SHA512 SSDEEP

        sq.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sq.txt.tmp
        • Size 64KB
        • SHA256 bcdb455a65c67515349df32c327decbb5bd0ea4ed62e76f724242489ef3de181
        • MD5 SHA1 SHA512 SSDEEP

        sr-spl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp
        • Size 60KB
        • SHA256 d0017d709e65c5b7baa06505a8b57a58ac0334b2228d1af1b1c3cc0c9360ac20
        • MD5 SHA1 SHA512 SSDEEP

        descript.ion.tmp

        • Path C:\Program Files\7-Zip\descript.ion.tmp
        • Size 60KB
        • SHA256 953f2437fe1cf8523d4429a5dc7e1144a1bbd052cf84efb0bf82847c33822bbd
        • MD5 SHA1 SHA512 SSDEEP

        tipresx.dll.mui.tmp

        • Path C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp
        • Size 70KB
        • SHA256 a030ee9315d958a99381f71966d3d99d0f56c0790b4106468807bacd946fa362
        • MD5 SHA1 SHA512 SSDEEP

        _.files.exe

        • Path C:\Users\Admin\AppData\Local\Temp\_.files.exe
        • Size 59KB
        • SHA256 513cd8b5cf6684e91f99820015d5ce8989e268aeb8dcd32051d82608525aaafb
        • MD5 SHA1 SHA512 SSDEEP

        Zombie.exe

        • Path C:\Windows\SysWOW64\Zombie.exe
        • Size 58KB
        • SHA256 7f9770167a6565370acc18e0e567593da0c558fb449d43018f64ed007cd3e976
        • MD5 SHA1 SHA512 SSDEEP

        memory/1520-0-0x0000000000400000-0x000000000040A000-memory.dmp

        memory/3464-12-0x0000000000400000-0x000000000040A000-memory.dmp