Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 21:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe
- Size 233KB
- Sample240613-1lpgfs1elf
- SHA256 3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2
- MD5 03ca431debf904556ba270249bed2a5f
- SHA1 b17f4914cfd132f6db847be40d63bc5d412e70b8
- SHA512 931bd039c35d3f757dd0862f9c3c71adf868b727b3823a981dfe4876963cd984d852d32eadcd7d35896229ec715489ca1006a1e7d10f2a016ceba3c92aadaa21
- SSDEEP 3072:6DWpwE7oL2e+efZwZ9SWu0SWurE9tHpKrvGCLOwstyhZFChcssc56FUrgxvbSD41:dN/e+efiHSWu0SWuI95pK7ShcHUab
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (5194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 2264 Zombie.exe 1628 _clist.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\Microsoft.VisualBasic.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\calendars.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntime2019R_PrepidBypass-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Excel.ReportingServices.QueryDesigners.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.IO.Packaging.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Printing.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial4-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-80.png.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\jfxswt.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Formats.Tar.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\jsound.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\tzmappings.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\rsod\powerpoint.x-none.msi.16.x-none.tree.dat.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Tools.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\te.pak.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\OCSCLIENTWIN32.DLL.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\wpfgfx_cor3.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms.tmp Zombie.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3612 wrote to memory of 2264 3612 3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe 83 PID 3612 wrote to memory of 2264 3612 3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe 83 PID 3612 wrote to memory of 2264 3612 3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe 83 PID 3612 wrote to memory of 1628 3612 3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe 82 PID 3612 wrote to memory of 1628 3612 3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe"C:\Users\Admin\AppData\Local\Temp\3887af11226f62875f738318e6da1f32d207196b67ca9ad6ed014aa36ef361d2.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\_clist.exe"_clist.exe"2⤵
- Executes dropped EXE
PID:1628
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2264
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe
- Size 90KB
- SHA256 73c50294d80297b267b60c8cbf5a05b1deb24eb23c968693fe14320c4757e584
- MD5 d2602dac60b517681f606e9362d27cff
- SHA1 b60bbb958974bdd8cd4d2be269c2def10c26a907
- SHA512 114851cb07eacc64764c8ca1d9bb140837f3c0d9bd9926e10f275bbf28bda32f5049f5d590127f180181be3152136f7d17473a110202a19de15b1f48f3dda355
- SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZavCSWu0SWuP:6DWpwE7oL2e+efZwZ9SWu0SWuP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_clist.exe
- Size 143KB
- SHA256 fb7fab836f744d669451dcd38aa7d2a9c74c6af893c258d079439b58abce70d8
- MD5 b27ea830fb39bc056e65f9a2260ae216
- SHA1 b69e40ee5cabe0721d2d1e9fbdd4088fd87592d6
- SHA512 22cad79d90a949174828ee5e3ce621113591c7c991c55c1a6a44a4555002adeb3bcbd9bab6cfbbfdefd663b76ac2dae96d70a01c527b312c7e8d223334a30219
- SSDEEP 3072:WE9tHpKrvGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2ExX:J95pK7ShcHUac
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 90KB
- SHA256 44766dbcd37a6996f37a83990caab45e1e9a4881fe9b66215a0713035ad92be6
- MD5 5b0fa9c004f65c51d3b0309ae4e60f13
- SHA1 98b17add102ace5f1d3615343f447c790963a328
- SHA512 8424bd7c2838496b4f010d1b5547f486c680d059362e53095d15c21a401abc20db4de38778f941bf4f7f7a2e3d0cde784baa77a6ba4a9b4b6121d7dbf99fb1fb
- SSDEEP 1536:W7ZDpApYbWjIlE77ufL2e+efZwZavCSWu0SWun:6DWpwE7oL2e+efZwZ9SWu0SWun
- MD5 SHA1 SHA512 SSDEEP