Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
11/06/2024, 04:25
Behavioral task
behavioral1
Sample
e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe
- Size 420KB
- Sample240611-e14zsstgng
- SHA256 e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8
- MD5 b8001cb67c8bacc7cfb1e71bcbf37c04
- SHA1 41283b39363ed4a2df33926cc7c4a1d2545d729f
- SHA512 e61ce9ddd2a401ce33dba4fcf8a6724317ed10275d7fb8eea5400329062c82f014a869b7e96d04b7f7e06fe8481074d05aa58c6fa98be3b805dca399ba6892c2
- SSDEEP 12288:XAIuZAIuyxJxMqzBDJkk2ERvT8MPAf/O6k:AxJxMqFDJkxqo4Af/3k
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4720) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- UPX dump on OEP (original entry point) 5 IoCs
resource yara_rule behavioral2/memory/4696-0-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x0008000000023467-6.dat UPX behavioral2/memory/2660-9-0x0000000000400000-0x000000000040B000-memory.dmp UPX behavioral2/files/0x000700000002346e-13.dat UPX behavioral2/memory/4696-21-0x0000000000400000-0x000000000040B000-memory.dmp UPX - Executes dropped EXE 2 IoCs
pid Process 2660 Zombie.exe 5048 _7z.exe -
resource yara_rule behavioral2/memory/4696-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0008000000023467-6.dat upx behavioral2/memory/2660-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000700000002346e-13.dat upx behavioral2/memory/4696-21-0x0000000000400000-0x000000000040B000-memory.dmp upx - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Serialization.Json.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.DataContractSerialization.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.deps.json.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-locale-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipTsf.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaremr.dll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\CLICK.WAV.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f7\FA000000007.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL.HXS.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\he.pak.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe.manifest.tmp Zombie.exe File created C:\Program Files\7-Zip\readme.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Tasks.Dataflow.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.Extensions.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TabTip.exe.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.Win32.SystemEvents.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\fxplugins.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Resources.Reader.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-file-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.Win32.Primitives.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\netstandard.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_EnterpriseSub_Bypass30-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.CSharp.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemXml.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\msvcp120.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\fxplugins.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-100.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms.tmp Zombie.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4696 wrote to memory of 2660 4696 e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe 83 PID 4696 wrote to memory of 2660 4696 e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe 83 PID 4696 wrote to memory of 2660 4696 e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe 83 PID 4696 wrote to memory of 5048 4696 e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe 84 PID 4696 wrote to memory of 5048 4696 e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe 84 PID 4696 wrote to memory of 5048 4696 e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe"C:\Users\Admin\AppData\Local\Temp\e5463e1ee36d6f27bd475b98e8c5576e5b761abcfe01fceeac90adce46f108b8.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2660
-
-
C:\Users\Admin\AppData\Local\Temp\_7z.exe"_7z.exe"2⤵
- Executes dropped EXE
PID:5048
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-1162180587-977231257-2194346871-1000\desktop.ini.exe
- Size 96KB
- SHA256 eaf4c700764343c4159d5743fd73fcfda82059574080d44a38160f520d6be25a
- MD5 2d10f93844240ac280b1835e834978d7
- SHA1 6731c61b2f5e9890e7025c7fc4a619477020740d
- SHA512 87442b6841da05aa09b1e5a5408ef3738214f56024b08719a168eb723326304f6b6ebc7f89cc7bb55a59846093c1740a3fb2ddc7720875e330bfe24f23580abb
- SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQulg:enaym3AIuZAIuyxJrQulg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_7z.exe
- Size 324KB
- SHA256 9e2631c19b243c28b0980607ced2540e9447b1166572483475547c1a9dd4ac0e
- MD5 7187ae605f4dce14bb23ea2623956335
- SHA1 f7c1df33b875c98f41dcde24117d89d42d25b7ce
- SHA512 f64522e2fb6bb61884fe53c34e79b355efb9ec33c02b2cd67d729af7d763e7b3873a5c7ce6ac7bb4567e6bcf8c70cadbc66f511e8bb151ab05096a832032bc8f
- SSDEEP 6144:J5lqo52kDzMYDJSi7+Ni2ER9Vh98+1PrEVhkQf0huIDaLOjm:JMqzBDJkk2ERvT8MPAf/O6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 96KB
- SHA256 7b61abab5027b6452db8e8405e64b902d9f83aa6f65854a7055f48daad8ef6b2
- MD5 5829fa8dc997f814aec5aab48c031cf2
- SHA1 bfcb09138d6f55824c5ccb1f3c3efa7c4b0ec180
- SHA512 c61def35c728dadfbbf097cc0c06aa4f5de1663ad17003b0339c6d0d591cb1ef3adcf6eb9cf7555e5de3e0c942e514e55139dc1dee68084b399e7fdc3a782774
- SSDEEP 1536:a7ZyqaFAlsr1++PJHJXFAIuZAIuyxX5rQul2:enaym3AIuZAIuyxJrQul2
- MD5 SHA1 SHA512 SSDEEP