Analysis

  • max time kernel
    150s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 03:16

General

  • Target
    cc010a37ff6480e9d692cdaf9380f3108c92bc9ed679a9206e7808d79ef2d7a2.exe
  • Size 96KB
  • Sample240611-dslmtasbrf
  • SHA256 cc010a37ff6480e9d692cdaf9380f3108c92bc9ed679a9206e7808d79ef2d7a2
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10

Malware Config

Signatures

  • Renames multiple (5360) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc010a37ff6480e9d692cdaf9380f3108c92bc9ed679a9206e7808d79ef2d7a2.exe
    "C:\Users\Admin\AppData\Local\Temp\cc010a37ff6480e9d692cdaf9380f3108c92bc9ed679a9206e7808d79ef2d7a2.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Users\Admin\AppData\Local\Temp\_KB2919442.nuspec.exe
      "_KB2919442.nuspec.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:3240
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:1352

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        desktop.ini.exe

        • Path C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.exe
        • Size 50KB
        • SHA256 9ffda33e25e643dafd3b136361207410cfeba886daf8587ce9a4a2f6c4ed2db1
        • MD5 SHA1 SHA512 SSDEEP

        desktop.ini.exe.tmp

        • Path C:\$Recycle.Bin\S-1-5-21-3906287020-2915474608-1755617787-1000\desktop.ini.exe.tmp
        • Size 97KB
        • SHA256 3d30994a40dccbb0d904aaf3b7b73a693ab535ca50e01fb0e157c02256ee2934
        • MD5 SHA1 SHA512 SSDEEP

        7-zip.chm.exe

        • Path C:\Program Files\7-Zip\7-zip.chm.exe
        • Size 162KB
        • SHA256 4399a1f05655f2819088af81f4ac6927c549d5265c1630947b9dd3f6d8b142be
        • MD5 SHA1 SHA512 SSDEEP

        7-zip.dll.exe

        • Path C:\Program Files\7-Zip\7-zip.dll.exe
        • Size 149KB
        • SHA256 6a485f6ea6c20415b9641979373bb2d2a1c82d3bbfa0495ef2de0810d95940b5
        • MD5 SHA1 SHA512 SSDEEP

        7z.dll.tmp

        • Path C:\Program Files\7-Zip\7z.dll.tmp
        • Size 1.8MB
        • SHA256 0d53470d377001a03d02b892595c13fdf9a6b9eb23a957d658fa0c75388a9e4d
        • MD5 SHA1 SHA512 SSDEEP

        7z.sfx.tmp

        • Path C:\Program Files\7-Zip\7z.sfx.tmp
        • Size 259KB
        • SHA256 229b6c6896dd4cd8ec28b2d4e00be8599d029cfdada98075f26df4ee7cbf0bba
        • MD5 SHA1 SHA512 SSDEEP

        7zCon.sfx.tmp

        • Path C:\Program Files\7-Zip\7zCon.sfx.tmp
        • Size 238KB
        • SHA256 7ca5efbbd4648b54c9ab70528702f90d5a7cb180cc4a979fc3812b3e3d2cb123
        • MD5 SHA1 SHA512 SSDEEP

        7zFM.exe.tmp

        • Path C:\Program Files\7-Zip\7zFM.exe.tmp
        • Size 980KB
        • SHA256 3ecaf77dd3d0a47545debe0bce4dc5bb54755b7dcd85ab4eeae69638529ecd99
        • MD5 SHA1 SHA512 SSDEEP

        7zG.exe.tmp

        • Path C:\Program Files\7-Zip\7zG.exe.tmp
        • Size 734KB
        • SHA256 55bc055584fedf8aaba1943984c45c88b30402dd94d9285b04bd9356b8690be7
        • MD5 SHA1 SHA512 SSDEEP

        History.txt.tmp

        • Path C:\Program Files\7-Zip\History.txt.tmp
        • Size 107KB
        • SHA256 40b51a6895c7b8c7d0945323651037b444a3aabb273719dd1be4e3eb13fc659b
        • MD5 SHA1 SHA512 SSDEEP

        af.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\af.txt.tmp
        • Size 59KB
        • SHA256 bfc44cdc30148aaa8668c2ff33f95b1a77574034253d946e262a162b1797083a
        • MD5 SHA1 SHA512 SSDEEP

        ar.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ar.txt.tmp
        • Size 59KB
        • SHA256 49c4fb1887ce171df8ce7ae5b840eac55eb3ef04374f622a78c2ba7ae97363ec
        • MD5 SHA1 SHA512 SSDEEP

        az.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\az.txt.tmp
        • Size 56KB
        • SHA256 0ca716a81fe5035c22c46773e21f1a226c1d262c9a0a6ca5d7f2b7b6ef09c733
        • MD5 SHA1 SHA512 SSDEEP

        bn.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\bn.txt.tmp
        • Size 64KB
        • SHA256 3a4a2fae95310fd585edc08337c9c2b360efbd1acc8398f063924709e55bf77a
        • MD5 SHA1 SHA512 SSDEEP

        br.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\br.txt.tmp
        • Size 55KB
        • SHA256 f839c26c0378d1948bc8507b3e147e2af320a3e3c89fc6c52b85cacaf851f2f0
        • MD5 SHA1 SHA512 SSDEEP

        ca.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ca.txt.tmp
        • Size 55KB
        • SHA256 1842ca52899aecc6e3f0d07f550e16b3babe5edf064966ccccf15ee3a301a9e4
        • MD5 SHA1 SHA512 SSDEEP

        co.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\co.txt.tmp
        • Size 57KB
        • SHA256 fad4a7fa2d8069c747772fe3437c266b9dc86a4ff0eea1a1d760e8f3236917de
        • MD5 SHA1 SHA512 SSDEEP

        cs.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\cs.txt.tmp
        • Size 59KB
        • SHA256 4f94616e670b6510d1c79ebeb6fe5ee3575fc49cd907941811700ffcf8d2050d
        • MD5 SHA1 SHA512 SSDEEP

        cs.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\cs.txt.tmp
        • Size 59KB
        • SHA256 9fb8b1545c4c3406d8e10ffaaba0403a63e6a6cf8e34b288ec749eec5e91f044
        • MD5 SHA1 SHA512 SSDEEP

        da.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\da.txt.tmp
        • Size 58KB
        • SHA256 0a21188fcd09330beb78c69213ae5230d4e64cee5148fd0cb74e0d91eec37683
        • MD5 SHA1 SHA512 SSDEEP

        de.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\de.txt.tmp
        • Size 59KB
        • SHA256 9a3c0c7abc66d01966f948ec20fddfa21f9d12bf259e452f39ecf008d3660fb5
        • MD5 SHA1 SHA512 SSDEEP

        el.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\el.txt.tmp
        • Size 66KB
        • SHA256 5f61ea4d85cbde23b83a9b580e612d4065b3adbbc4625a231b4557959ad34c7a
        • MD5 SHA1 SHA512 SSDEEP

        el.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\el.txt.tmp
        • Size 66KB
        • SHA256 22a15c6ad04492571696ca05fd445b30f706ca7431a8e03c10303abf7875ece3
        • MD5 SHA1 SHA512 SSDEEP

        eo.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\eo.txt.tmp
        • Size 52KB
        • SHA256 15db227691fe36670114a9ac5f4e60cc7803dfc6bee9f5b8e7346f5df4e4ca25
        • MD5 SHA1 SHA512 SSDEEP

        et.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\et.txt.tmp
        • Size 53KB
        • SHA256 9a7801f08ab9dc2ce9e61ca2064d450ca63a3d08a6abae1dcaeff244001d33ba
        • MD5 SHA1 SHA512 SSDEEP

        fa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fa.txt.tmp
        • Size 60KB
        • SHA256 9f5704babff46e6140db288385fc448e3defd96a708808bd4c4cbe37d2c598d6
        • MD5 SHA1 SHA512 SSDEEP

        fr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fr.txt.tmp
        • Size 59KB
        • SHA256 2d7bcbdca70bcebda0c921332e05714e4deb1f4c43d8b92f1636ab070c1aebcd
        • MD5 SHA1 SHA512 SSDEEP

        fur.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fur.txt.tmp
        • Size 57KB
        • SHA256 f914d01c259c2c4597919464de8033b9f2a0a8d525f38596f662e4357e0fccf3
        • MD5 SHA1 SHA512 SSDEEP

        ga.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ga.txt.tmp
        • Size 58KB
        • SHA256 bacaabfb54c91d3253ffbf8df24daa2f4a42c31daad6544b1e3fb9f8786246ca
        • MD5 SHA1 SHA512 SSDEEP

        gu.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\gu.txt.tmp
        • Size 67KB
        • SHA256 ddca48d6f52337a46694a4c8bf39426697b7d7d72e5c5f4d631f434620af6d7f
        • MD5 SHA1 SHA512 SSDEEP

        he.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\he.txt.tmp
        • Size 58KB
        • SHA256 9a32876a78e88f6cea8cc9c785c8c5447e4cf0fb20fea9aad3ccb6d82bee0c23
        • MD5 SHA1 SHA512 SSDEEP

        hr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hr.txt.tmp
        • Size 48KB
        • SHA256 5bc1746fa4e649a818a873acd916a7bdb900e16bb0e364e0b9cfbb099c86dc97
        • MD5 SHA1 SHA512 SSDEEP

        hu.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hu.txt.tmp
        • Size 60KB
        • SHA256 5cf817bee69a2c5d22dc3eab12279d88679662a8a3e9be47a2511199090cfcb2
        • MD5 SHA1 SHA512 SSDEEP

        hy.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hy.txt.tmp
        • Size 63KB
        • SHA256 748590773d21b4899ce83beba684d14aabba2114fe04a9e1b65176d0792378df
        • MD5 SHA1 SHA512 SSDEEP

        io.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\io.txt.tmp
        • Size 59KB
        • SHA256 4d5ecf920340336c45da357d9eabac446446b62cdd0a655cf911624ab0740349
        • MD5 SHA1 SHA512 SSDEEP

        it.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\it.txt.tmp
        • Size 59KB
        • SHA256 df4c0064025b0bf0c59a4d9d994e24249a6c1a7c8689466692dcb8b0f2c87580
        • MD5 SHA1 SHA512 SSDEEP

        it.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\it.txt.tmp
        • Size 59KB
        • SHA256 b9318bd8522ef0c42c020116e19f4b4785a161e2922837ae4a078c047f1a8234
        • MD5 SHA1 SHA512 SSDEEP

        kaa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\kaa.txt.tmp
        • Size 58KB
        • SHA256 f6c99a3fc399e27054a6cfdf0b907799e95bf8f9f2da686d619df59f6903b9de
        • MD5 SHA1 SHA512 SSDEEP

        kab.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\kab.txt.tmp
        • Size 58KB
        • SHA256 44cec13274c1a4e24877cce484edf8e0a5264e1ae9b8e98678b4104f8cbcfde8
        • MD5 SHA1 SHA512 SSDEEP

        ko.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ko.txt.tmp
        • Size 60KB
        • SHA256 e28cc1562129968f585eb9fbb63360447ded20f4452dbb328c727024b932b671
        • MD5 SHA1 SHA512 SSDEEP

        ku.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ku.txt.tmp
        • Size 52KB
        • SHA256 3bfac9327cc21bec50c21cb7dd2659d02d3d1b3ea112f4934cbf0fff723b12a1
        • MD5 SHA1 SHA512 SSDEEP

        ky.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ky.txt.tmp
        • Size 59KB
        • SHA256 3ca1472237137e1746dcc014e7e9e2c7165d0465d0fab29bb4b1b52b3630be4b
        • MD5 SHA1 SHA512 SSDEEP

        lij.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\lij.txt.tmp
        • Size 57KB
        • SHA256 7da5294bf3f1ad0407f852161436240f108d7248111e7a76be99ca8adf5e2aff
        • MD5 SHA1 SHA512 SSDEEP

        lv.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\lv.txt.tmp
        • Size 55KB
        • SHA256 551d7cad92abb07e9bac457859804321699ab205d005eafca87b49eb0df1f305
        • MD5 SHA1 SHA512 SSDEEP

        mk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mk.txt.tmp
        • Size 55KB
        • SHA256 3f50d6cf7e4f1c5a259033219721c542ae35f6a245fef0a9fb71d706ff0361b3
        • MD5 SHA1 SHA512 SSDEEP

        mng.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mng.txt.tmp
        • Size 68KB
        • SHA256 5e4b2eeab7e606c46f32ad15f98cce55e4f5b3044a6a7ec7e5a8ffac41596770
        • MD5 SHA1 SHA512 SSDEEP

        mr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mr.txt.tmp
        • Size 60KB
        • SHA256 04035afe22823040761b5d5a17aa80d1d93e79d77c39232dfbd615136e69f5f9
        • MD5 SHA1 SHA512 SSDEEP

        ne.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ne.txt.tmp
        • Size 63KB
        • SHA256 cd1e7a75d004cfa92b94a847b34b24672ff72e35c082ebcade43dd22aedbbae6
        • MD5 SHA1 SHA512 SSDEEP

        pl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\pl.txt.tmp
        • Size 56KB
        • SHA256 6516aed784a330a2e50096afc6db4dd6adb6d244926bf23958f3d88e1f345bd6
        • MD5 SHA1 SHA512 SSDEEP

        ps.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ps.txt.tmp
        • Size 55KB
        • SHA256 efe17c3172fe10030907f1fe8b91dc59a77fa7da0c7a79d40a3094d35a182e19
        • MD5 SHA1 SHA512 SSDEEP

        pt-br.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\pt-br.txt.tmp
        • Size 56KB
        • SHA256 838509aa329fe1cf04216f17576b1af554d0ead59c0f07c4a3e7cef8d37a1cd7
        • MD5 SHA1 SHA512 SSDEEP

        ru.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ru.txt.tmp
        • Size 61KB
        • SHA256 13cacaa4df6358d36fe034db07d9130d72900bed66b3e71ef348c80907af658a
        • MD5 SHA1 SHA512 SSDEEP

        sa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sa.txt.tmp
        • Size 64KB
        • SHA256 74a14fddb681e76957fcc078e8aa7c9e21b05844ca669b041ef87c8be60920e9
        • MD5 SHA1 SHA512 SSDEEP

        si.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\si.txt.tmp
        • Size 68KB
        • SHA256 20789ab2419c32995f47a58528fde49309f75573384810a6b3ff59a1a8ddcb91
        • MD5 SHA1 SHA512 SSDEEP

        sk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sk.txt.tmp
        • Size 56KB
        • SHA256 f525ff858ae77f15cefcd077b224051e54d60775721a2ea25bb357193f671847
        • MD5 SHA1 SHA512 SSDEEP

        sq.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\sq.txt.tmp
        • Size 52KB
        • SHA256 89a9c7a4c331d49c6e1b79e429d675048af01cbe26ff302bc20fd80d439fa3f2
        • MD5 SHA1 SHA512 SSDEEP

        HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp

        • Path C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcDemoR_BypassTrial365-ul-oob.xrm-ms.tmp
        • Size 58KB
        • SHA256 2a2ff73e74a0a32cd6bed67eef7ec4ed1d1e015ee0d8af0b2df364e469be3403
        • MD5 SHA1 SHA512 SSDEEP

        _KB2919442.nuspec.exe

        • Path C:\Users\Admin\AppData\Local\Temp\_KB2919442.nuspec.exe
        • Size 50KB
        • SHA256 e48a0c94c795c22ccf0cd5b17a1ddcb36289bc59c00f40b941c699e7a49505f6
        • MD5 SHA1 SHA512 SSDEEP

        Zombie.exe

        • Path C:\Windows\SysWOW64\Zombie.exe
        • Size 46KB
        • SHA256 3573166fad396acf5800a86e0b6d20eec37ba2102ecb293428f1f621e2f3c15c
        • MD5 SHA1 SHA512 SSDEEP

        memory/2584-0-0x0000000000400000-0x0000000000408000-memory.dmp

        memory/3240-14-0x0000000000400000-0x0000000000408000-memory.dmp