102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24/06/2024, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe
Size

193KB
MD5

eed7f1aeb5610e8c87dc087a925cb6b5
SHA1

341d1f99789f0c4c43e20237a5c08e7c6868cad8
SHA256

102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1
SHA512

f6d56fa9fc8c2eb58dfc7909fd61a0f165fdf1e8062b039ea97f350bb005c1eedda52364366f7a54cf5892612514127802407456b8d22d8f40822970c4f9e71a
SSDEEP

3072:9QWp+KCD98HpKI6GCLOwstyhZFChcssc56FUrgxvbSD4UQrO2LxJ:LMKG9GpKbShcHUan

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (3697) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2332	_choco.exe
1248	Zombie.exe

Loads dropped DLL 3 IoCs

pid	Process
2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe
2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe
2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\highDpiImageSwap.js.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fr.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.xml.tmp	Zombie.exe
File created	C:\Program Files\Windows Journal\de-DE\NBMapTIP.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.nl_zh_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	Zombie.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CENTEURO.TXT.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\RSSFeeds.html.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\FreeSans.ttf.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\settings.js.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\ext\jaccess.jar.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui_3.106.0.v20140812-1751.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\servertool.exe.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Pyongyang.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-spi-actions_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_dummy_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msaddsr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-image-mask.png.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_chromaprint_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\ImagingDevices.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Sao_Paulo.tmp	Zombie.exe
File created	C:\Program Files\Windows Journal\Templates\Genko_1.jtp.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\glow.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Glace_Bay.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\picturePuzzle.js.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\5.png.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	Zombie.exe
File created	C:\Program Files\Windows Journal\PDIALOG.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-explorer.jar.tmp	Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_hov.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Chagos.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\installer.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\security\blacklist.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay.tmp	Zombie.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2332	2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe	29
PID 2960 wrote to memory of 2332	2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe	29
PID 2960 wrote to memory of 2332	2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe	29
PID 2960 wrote to memory of 2332	2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe	29
PID 2960 wrote to memory of 1248	2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe	28
PID 2960 wrote to memory of 1248	2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe	28
PID 2960 wrote to memory of 1248	2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe	28
PID 2960 wrote to memory of 1248	2960	102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe	28

C:\Users\Admin\AppData\Local\Temp\102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe
"C:\Users\Admin\AppData\Local\Temp\102bd82cfa5cfd3edec30d64861f6b6a231c73847870b7d83981d17402f258f1.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1248
- C:\Users\Admin\AppData\Local\Temp\_choco.exe
  "_choco.exe"
  2⤵
  - Executes dropped EXE
  PID:2332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp

Filesize
51KB

MD5
cb378d62ea34d51d03daca637ff8ddc7

SHA1
417f10c0f2caa1bc5d11811c1d1060ebcbbb7570

SHA256
2bffcafdb55387a8e212a6a88e10d4e3e2661bcb985e3874c921cad3cb4e35ac

SHA512
940b7ea0ed38617b518e93793866a82fc04c5091c1466205fe5e56a30be4459bd28ae190e6a502c134ec281cee3f6dc07a4fafb1e78c546746316fbf3f5dbb59

Download Submit
\Users\Admin\AppData\Local\Temp\_choco.exe

Filesize
142KB

MD5
81a7c181639679983efb07c2dea2ebd0

SHA1
93370e8e5cb0d89bf6786445f94dd02dbb84b574

SHA256
8320c7f90f65b48e4031b680506a9579751789ded4d90fa2fbfc2fb7db7e3ec8

SHA512
599cca13e527c92cdf88df06ed8a01eee1bc602c565ab69e251f7414e19833ce42f0453771bfdf27d16f9f70112835b599d26a6ed92901fdf86bbdf8adf4d2f7

Download Submit
\Windows\SysWOW64\Zombie.exe

Filesize
50KB

MD5
90de464feb95b49ed53907b8c231fb5e

SHA1
423ef93af2fded7559de5d3992ce76ba2701704b

SHA256
b7cf917bbe401f95bd1f001bbf70594fd0ba4b181006ddac2d8aedb756fa3a7b

SHA512
6605ad3135ce3afbbced7717ffae8b9cbf14d821af9396f952603d209e81661695998665166f4fb6698550cdaf4d4d6a50c5f779bc603f46477e3e7c28ac67f7

Download Submit
memory/2332-21-0x000007FEF50D3000-0x000007FEF50D4000-memory.dmp

Filesize
4KB

Download
memory/2332-22-0x0000000001200000-0x0000000001228000-memory.dmp

Filesize
160KB

Download
memory/2960-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2960-15-0x00000000002C0000-0x00000000002C8000-memory.dmp

Filesize
32KB

Download
memory/2960-23-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download