Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2024, 22:28

General

  • Target
    6f374e2e890eccce2ccb3250edf9f3fe6a8c6e376ef7e89d04bda702235da876.exe
  • Size 158KB
  • Sample240616-2dr32svflj
  • SHA256 6f374e2e890eccce2ccb3250edf9f3fe6a8c6e376ef7e89d04bda702235da876
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10

Malware Config

Signatures

  • Renames multiple (5080) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6f374e2e890eccce2ccb3250edf9f3fe6a8c6e376ef7e89d04bda702235da876.exe
    "C:\Users\Admin\AppData\Local\Temp\6f374e2e890eccce2ccb3250edf9f3fe6a8c6e376ef7e89d04bda702235da876.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3704
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:4140
    • C:\Users\Admin\AppData\Local\Temp\_MS.WINWORD.12.1033.hxn.exe
      "_MS.WINWORD.12.1033.hxn.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      PID:3368

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        desktop.ini.exe.tmp

        • Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe.tmp
        • Size 159KB
        • SHA256 ced7e30b1fdc44ec138d62e12880b92a401a47a47e99f785c1752e2304ae5c40
        • MD5 SHA1 SHA512 SSDEEP

        desktop.ini.tmp

        • Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp
        • Size 79KB
        • SHA256 2a5e5e7183cc6b82b6214b491bf8210bd3a92026e3b4f5c35b91b2fbc514bcd6
        • MD5 SHA1 SHA512 SSDEEP

        7-zip.chm.exe

        • Path C:\Program Files\7-Zip\7-zip.chm.exe
        • Size 191KB
        • SHA256 261970a38fd1789d2efb59fcff8d98e77c64c16b9bc6e3a6c7d60dd276b8f2ee
        • MD5 SHA1 SHA512 SSDEEP

        7-zip.dll.exe

        • Path C:\Program Files\7-Zip\7-zip.dll.exe
        • Size 178KB
        • SHA256 90366327cc254742fde9390f69121d5a693b608f25ed51a8da226f1edaf27587
        • MD5 SHA1 SHA512 SSDEEP

        7z.dll.tmp

        • Path C:\Program Files\7-Zip\7z.dll.tmp
        • Size 620KB
        • SHA256 e8dbba008494889e46bbce248fcfe0afef6e652d296868989578760e70784c16
        • MD5 SHA1 SHA512 SSDEEP

        7z.dll.tmp

        • Path C:\Program Files\7-Zip\7z.dll.tmp
        • Size 1.8MB
        • SHA256 9882280e104c7bdef10fd127a18b26ee8a5e3956e9a37a78594e7eaa3ecebe22
        • MD5 SHA1 SHA512 SSDEEP

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 623KB
        • SHA256 24729d67bc53cb0c1120d222afdcbd62524e19bfa88c7a58a89d171584c840a4
        • MD5 SHA1 SHA512 SSDEEP

        7z.sfx.tmp

        • Path C:\Program Files\7-Zip\7z.sfx.tmp
        • Size 288KB
        • SHA256 440dc2128fcea1477ea54da1d48b56d9be02348e166effe8756606349751b2ca
        • MD5 SHA1 SHA512 SSDEEP

        7zFM.exe.tmp

        • Path C:\Program Files\7-Zip\7zFM.exe.tmp
        • Size 344KB
        • SHA256 41746d7e6f2086796c57636f2df15ca4f700cd21a60744ef292285d12b59ee4c
        • MD5 SHA1 SHA512 SSDEEP

        7zFM.exe.tmp

        • Path C:\Program Files\7-Zip\7zFM.exe.tmp
        • Size 1010KB
        • SHA256 d6b7f631e501e752be2ae4e8ef57f05832f4576d7e8bdd8732feb7284fd5fcdc
        • MD5 SHA1 SHA512 SSDEEP

        7zG.exe.tmp

        • Path C:\Program Files\7-Zip\7zG.exe.tmp
        • Size 763KB
        • SHA256 21f4dfc8859d576e0bca4a235a89b5341dc2196c6293893294986caf1ff2d588
        • MD5 SHA1 SHA512 SSDEEP

        History.txt.tmp

        • Path C:\Program Files\7-Zip\History.txt.tmp
        • Size 136KB
        • SHA256 9194b313a6f7e4cb8171a8777e93a807597562d484a12e8463d42e3bcbe9c76b
        • MD5 SHA1 SHA512 SSDEEP

        an.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\an.txt.tmp
        • Size 86KB
        • SHA256 fda453062b118a6ebbf25c1034b8739ac4c1fa80d02be2e02d5d391eea06717d
        • MD5 SHA1 SHA512 SSDEEP

        ar.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ar.txt.tmp
        • Size 91KB
        • SHA256 472d26eeae7edca07f02465821698e8208dc22322b46755d8a9db00c9b76b77c
        • MD5 SHA1 SHA512 SSDEEP

        ast.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ast.txt.tmp
        • Size 84KB
        • SHA256 1d37dee91a909194808da3e98f2c83e611907bb09be3fced1b8351f08065e3e3
        • MD5 SHA1 SHA512 SSDEEP

        be.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\be.txt.tmp
        • Size 90KB
        • SHA256 fc3dc6a41fa33833598eaf4b546592897ca30394304fb27dbef5763af6ca8937
        • MD5 SHA1 SHA512 SSDEEP

        bg.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\bg.txt.tmp
        • Size 92KB
        • SHA256 72c302baea035a8140e0f832356261de886f42b93c50b66815b30a725bef0852
        • MD5 SHA1 SHA512 SSDEEP

        bn.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\bn.txt.tmp
        • Size 94KB
        • SHA256 7917fe1122db7fbd36181f48b1d89083fdfdc45de67bc166986266a288b5d92f
        • MD5 SHA1 SHA512 SSDEEP

        br.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\br.txt.tmp
        • Size 79KB
        • SHA256 d5123ff0ebd792e78d82ea60352c5df25cd0cfeb14bae10a958ab33d0c7dc614
        • MD5 SHA1 SHA512 SSDEEP

        ca.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ca.txt.tmp
        • Size 88KB
        • SHA256 f459bc43f40df245476e71ff07886f3be943827bda5a9fdb5414ea33d009f197
        • MD5 SHA1 SHA512 SSDEEP

        cy.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\cy.txt.tmp
        • Size 84KB
        • SHA256 1252aaefe16c9c7bed27a46bbadfa511efb362edd89c899fc97f7379e28883d8
        • MD5 SHA1 SHA512 SSDEEP

        da.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\da.txt.tmp
        • Size 88KB
        • SHA256 3ed44bfdc0963f770b31758ca02fc37adbea3ed7d727c9883c2c4c70055e8f54
        • MD5 SHA1 SHA512 SSDEEP

        eo.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\eo.txt.tmp
        • Size 85KB
        • SHA256 d1da33e1b090a4698720cb1e08467074c47a3a52b377564c37f18e4e07236ad6
        • MD5 SHA1 SHA512 SSDEEP

        et.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\et.txt.tmp
        • Size 86KB
        • SHA256 a93d532f4037ed325391d0e83bffa52f44bf3199b44062e7223c019940133a23
        • MD5 SHA1 SHA512 SSDEEP

        ext.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ext.txt.tmp
        • Size 87KB
        • SHA256 cd486f56154050a2ee1f270046d2160af3bc940bd9b4bc659c623c0aa706bc17
        • MD5 SHA1 SHA512 SSDEEP

        fa.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fa.txt.tmp
        • Size 93KB
        • SHA256 97de493a756e7e8f2ceda962b60b71b4fb17f6fbb75711a07612dbdee546a7a8
        • MD5 SHA1 SHA512 SSDEEP

        fi.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fi.txt.tmp
        • Size 88KB
        • SHA256 f42b68d31fb84c20175305f2f63d27ecf96cc745cc77b77975ff243cb4a2ffd1
        • MD5 SHA1 SHA512 SSDEEP

        fr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fr.txt.tmp
        • Size 89KB
        • SHA256 347e2c545a1100a2ac754b13ba79299a1848d4272e48d8feec0f4d0599c755fb
        • MD5 SHA1 SHA512 SSDEEP

        fur.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fur.txt.tmp
        • Size 87KB
        • SHA256 60b4ecc6214441b9b8dc1353423ac07f0ab8f68dea131d3f9b785b2674491196
        • MD5 SHA1 SHA512 SSDEEP

        fy.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\fy.txt.tmp
        • Size 85KB
        • SHA256 b5f5be4ac4c40adb2d00f7db879e0eabfdb7c2542aecfa5e0a531d38a1e9ce30
        • MD5 SHA1 SHA512 SSDEEP

        gu.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\gu.txt.tmp
        • Size 97KB
        • SHA256 8c3b966e73ae1dadd8523c65061865e87583b81293291e001c1df0df7f2314b7
        • MD5 SHA1 SHA512 SSDEEP

        he.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\he.txt.tmp
        • Size 91KB
        • SHA256 7eadb11b7e263c380457c75a0e23be14eeb754830cffd1f92aa4a0d71c43173f
        • MD5 SHA1 SHA512 SSDEEP

        hy.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\hy.txt.tmp
        • Size 93KB
        • SHA256 9425a3393365e5982f757b3b87e8452f094cbcdcd0d4466550ede7f0f1da4635
        • MD5 SHA1 SHA512 SSDEEP

        id.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\id.txt.tmp
        • Size 88KB
        • SHA256 e3c39f91195545f3b69a689c6475318073a8f7c9b5aa095f8293a6e6525704c7
        • MD5 SHA1 SHA512 SSDEEP

        is.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\is.txt.tmp
        • Size 88KB
        • SHA256 b63d6bbbd0c3bd542b3c39ef550c5a538f4b9dcaac1b7267572c2bbc187d73cb
        • MD5 SHA1 SHA512 SSDEEP

        it.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\it.txt.tmp
        • Size 88KB
        • SHA256 7c0e859ad33fef72560ba8e4987901f3c999560157d56391a6ca172b0ae8352a
        • MD5 SHA1 SHA512 SSDEEP

        ja.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ja.txt.tmp
        • Size 91KB
        • SHA256 60f6cde04980d625c3931bc0f9aec22bf320b5c65fa5d01ed0cc580fa5f368e2
        • MD5 SHA1 SHA512 SSDEEP

        ka.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ka.txt.tmp
        • Size 96KB
        • SHA256 cdf740604dd656aa437ff5cbf24c1eda6b50fb53a6859b2b310daab72d5d7109
        • MD5 SHA1 SHA512 SSDEEP

        kab.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\kab.txt.tmp
        • Size 87KB
        • SHA256 e294ba5ed84d000069815cff5e26c894007f99ecdc3b62384395605a4fc3e92b
        • MD5 SHA1 SHA512 SSDEEP

        kk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\kk.txt.tmp
        • Size 90KB
        • SHA256 b803774f7622e57530fd9243660b8614d9f89770c3a8a104ddd5900729299585
        • MD5 SHA1 SHA512 SSDEEP

        ku.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ku.txt.tmp
        • Size 84KB
        • SHA256 eb9d8031d2e292deb39ff7d82c572cf9392ceb9b70e9810b909b62cfe39e67c8
        • MD5 SHA1 SHA512 SSDEEP

        ky.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ky.txt.tmp
        • Size 92KB
        • SHA256 6615d108776965a26b4034c3f8624f44f867dcdacb208122955dbffe79430d09
        • MD5 SHA1 SHA512 SSDEEP

        lij.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\lij.txt.tmp
        • Size 87KB
        • SHA256 08a538ab8b8596ab1309ca0e7cf84dc6d3af499734cfc09bc75c98f5b171e7b8
        • MD5 SHA1 SHA512 SSDEEP

        lt.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\lt.txt.tmp
        • Size 89KB
        • SHA256 b29d499c0973f5f2453d0875d1664b18c639b776045eb6210b2aa27606721966
        • MD5 SHA1 SHA512 SSDEEP

        lv.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\lv.txt.tmp
        • Size 76KB
        • SHA256 84a0578c749a8713f9acb5245f27959f72dee3fce40438e20ce6cceaebc0bd1b
        • MD5 SHA1 SHA512 SSDEEP

        mk.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mk.txt.tmp
        • Size 88KB
        • SHA256 425364d654107119d289b280c1b855b43e39be275c5ec5ff576554ece2e61ce4
        • MD5 SHA1 SHA512 SSDEEP

        mn.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mn.txt.tmp
        • Size 88KB
        • SHA256 612d105cc5a2c996efbc4a405b337efca31abcc26a2afdd4443a43903318a803
        • MD5 SHA1 SHA512 SSDEEP

        mng.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mng.txt.tmp
        • Size 98KB
        • SHA256 8614fbeba1c0ca62f8712c64bfe065cfad9cd039165ea3463db39be8f9ffa81d
        • MD5 SHA1 SHA512 SSDEEP

        mr.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\mr.txt.tmp
        • Size 90KB
        • SHA256 1a22118ebab1def8340c358acf1429d2efe9e6f81398cfc805eac300671d5f15
        • MD5 SHA1 SHA512 SSDEEP

        ms.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ms.txt.tmp
        • Size 84KB
        • SHA256 7ca348174c98eabf844c7c3e6f785ddd925e85e1a93e9ae2978a76e1aaf41920
        • MD5 SHA1 SHA512 SSDEEP

        ne.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\ne.txt.tmp
        • Size 79KB
        • SHA256 f0d7c044ee549ad8dc389a90cac6984f76b1b5c7079bc9182e2c4ecd1cc9f4d3
        • MD5 SHA1 SHA512 SSDEEP

        nl.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\nl.txt.tmp
        • Size 89KB
        • SHA256 fd1216709e6e897bc7a680275573625d282319a5a310bda4c36ea24cd5aab5a2
        • MD5 SHA1 SHA512 SSDEEP

        nn.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\nn.txt.tmp
        • Size 84KB
        • SHA256 168378df8fe356ce732a24647b30a8f4604f7f884d81817702faaeb3504be5a3
        • MD5 SHA1 SHA512 SSDEEP

        pa-in.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\pa-in.txt.tmp
        • Size 93KB
        • SHA256 ee55c31b6500c6293bf227f68781f973ca07d66e82dfb956ddc198037a5ed296
        • MD5 SHA1 SHA512 SSDEEP

        pt.txt.tmp

        • Path C:\Program Files\7-Zip\Lang\pt.txt.tmp
        • Size 88KB
        • SHA256 42408ecab88b92422266b566b047bb293161bc7d40143ffdc22d0d55ffbb8236
        • MD5 SHA1 SHA512 SSDEEP

        descript.ion.tmp

        • Path C:\Program Files\7-Zip\descript.ion.tmp
        • Size 80KB
        • SHA256 05116fb40e5f38e701f8c49ad8f499ab4d13955ddb5b2504e0ea70cbb880bdeb
        • MD5 SHA1 SHA512 SSDEEP

        InkObj.dll.mui.tmp

        • Path C:\Program Files\Common Files\microsoft shared\ink\it-IT\InkObj.dll.mui.tmp
        • Size 84KB
        • SHA256 9892a2d8c651a6fad0ee42f74c68d363ca0cf9b1cde365802b0e9f7e866e0509
        • MD5 SHA1 SHA512 SSDEEP

        _MS.WINWORD.12.1033.hxn.exe

        • Path C:\Users\Admin\AppData\Local\Temp\_MS.WINWORD.12.1033.hxn.exe
        • Size 79KB
        • SHA256 bad3abd3f933d51107e0f145def6bc27701b9bdf33baa6edbf51518c21973e26
        • MD5 SHA1 SHA512 SSDEEP

        Zombie.exe

        • Path C:\Windows\SysWOW64\Zombie.exe
        • Size 79KB
        • SHA256 bd2d009e419178d1c479c627ca7284d714836d6c0849edfd4a685dc509b6e2f2
        • MD5 SHA1 SHA512 SSDEEP