87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
23/06/2024, 23:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe
Size

502KB
MD5

f4f58a4f9f829e8a848e2e90a21c6cc4
SHA1

43a65e5c7d4a2be1cd24c3060732a13a0613b5e8
SHA256

87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3
SHA512

709092131e2d0331bff10cb725c1ab9e1e8c529d8dc07e88735ab9703233de831e3ea50d0795a89baa70f33a239255bab0225ca6efd7709fc952a0f9a59b3927
SSDEEP

6144:PEYrIOXsqmWzJrdc6GJRQUWGUA9PRWLiFSbE56FORFL:I2lWRPWhA9PRWg97

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (5114) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4180	Zombie.exe
4472	_setup.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\Microsoft.Office.PolicyTips.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\af.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Process.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Collections.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Core.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jsound.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\plugin2\msvcp140.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.TypeConverter.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC32.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Violet II.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Client.Packaging.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OFFSYMXL.TTF.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tpcps.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Csp.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-TW\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ObjectModel.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\PresentationFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XmlDocument.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ms.pak.tmp	Zombie.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4472	_setup.exe
4472	_setup.exe
4472	_setup.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 4180	1156	87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe	83
PID 1156 wrote to memory of 4180	1156	87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe	83
PID 1156 wrote to memory of 4180	1156	87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe	83
PID 1156 wrote to memory of 4472	1156	87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe	84
PID 1156 wrote to memory of 4472	1156	87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe	84
PID 1156 wrote to memory of 4472	1156	87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe	84

C:\Users\Admin\AppData\Local\Temp\87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe
"C:\Users\Admin\AppData\Local\Temp\87a218d141c61d1f3d88633d5f72c22b96c9e62737a622d75c74d525637f39f3.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4180
- C:\Users\Admin\AppData\Local\Temp\_setup.exe
  "_setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4472

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3169499791-3545231813-3156325206-1000\desktop.ini.exe

Filesize
45KB

MD5
3dd45b8d4a104f0f6d32b7e41e11ecf8

SHA1
8605f30c098d9cf27aa9c2a1326baa3e206feec9

SHA256
a235705afc6a4a340d02c488f442cec37870ea98562989b981fa656d2a09be5a

SHA512
3f4df88af49bd8a93a52d38f178e5548cc28a42234d5500cddb0b77de530fc775ac0d01e9ff14008720f16bf0218e313cdbd9ed74169d4887bebf436a6dd7b8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_setup.exe

Filesize
457KB

MD5
446366ca32877e2290d0bd8f22e11809

SHA1
b620d296d53566d9a07c1cabc92c50d0f5c4f34a

SHA256
4b76c0ea832d58966f824cfedb9a3831b1c286b13cc22d56e29dad7966847184

SHA512
edbb4cd70b9c372f827136db217087451732f83a34af854ff031a659e9aee0fe849c0005a38d2bd19f438f8277147101a577fa900b89e2e1f804b369134255cf

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
45KB

MD5
5da943d5defacbf3c7637db9d666199e

SHA1
893e468bc234b4341d91912321a704d3b1079e5f

SHA256
6021df60b1cbb78a6859f6d0d329a66877100343202255f45b7d677c5a41dd9c

SHA512
c987ca49057cb3ddb89c837d6a4786c2e0aa3fa0db17e2c35ccb3236c29e06b647ccbcfaa0fd4dfe07bd81c8a9ce8f28e06c8d0ca84125244e45b03d8440bb66

Download Submit