e76aea8f8b3f8c2a1f1dd147604fea6154838c1eaf63c084103e476c6125835f

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 08:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91725855b62b4a8e6fdb576a1a4f8930N.exe
Size

219KB
MD5

91725855b62b4a8e6fdb576a1a4f8930
SHA1

7dae4db9e1c58de21a74b10f4e7bb46dde875bdb
SHA256

e76aea8f8b3f8c2a1f1dd147604fea6154838c1eaf63c084103e476c6125835f
SHA512

e2116cf004b69709dffe508bc5494e1712d5112b01d0b32bc2dd2558dfd64f36daf329ddb918a41e2882475b1b21748f9bf458178295b82ad172e2dba55addba
SSDEEP

3072:6DWpvD98HpKI6GCLOwstyhZFChcssc56FUrgxvbSD4UQrO2Lxh:dF9GpKbShcHUar

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (2836) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
1840	Zombie.exe
3068	_choco.exe

Loads dropped DLL 3 IoCs

pid	Process
2368	91725855b62b4a8e6fdb576a1a4f8930N.exe
2368	91725855b62b4a8e6fdb576a1a4f8930N.exe
2368	91725855b62b4a8e6fdb576a1a4f8930N.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	91725855b62b4a8e6fdb576a1a4f8930N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	91725855b62b4a8e6fdb576a1a4f8930N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\AST4.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png.tmp	Zombie.exe
File created	C:\Program Files\ApproveProtect.wax.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-javahelp.xml.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Samara.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ta.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dubai.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\net.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tehran.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_zh_CN.jar.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.RunTime.Serialization.Resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.zh_CN_5.5.0.165303.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Porto_Velho.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Budapest.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mazatlan.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Amsterdam.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\jni.h.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\YST9.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\CST6CDT.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IPSEventLogMsg.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\ieinstal.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_ja_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\masterix.gif.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\jp2launcher.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Matamoros.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1840	2368	91725855b62b4a8e6fdb576a1a4f8930N.exe	30
PID 2368 wrote to memory of 1840	2368	91725855b62b4a8e6fdb576a1a4f8930N.exe	30
PID 2368 wrote to memory of 1840	2368	91725855b62b4a8e6fdb576a1a4f8930N.exe	30
PID 2368 wrote to memory of 1840	2368	91725855b62b4a8e6fdb576a1a4f8930N.exe	30
PID 2368 wrote to memory of 3068	2368	91725855b62b4a8e6fdb576a1a4f8930N.exe	31
PID 2368 wrote to memory of 3068	2368	91725855b62b4a8e6fdb576a1a4f8930N.exe	31
PID 2368 wrote to memory of 3068	2368	91725855b62b4a8e6fdb576a1a4f8930N.exe	31
PID 2368 wrote to memory of 3068	2368	91725855b62b4a8e6fdb576a1a4f8930N.exe	31

C:\Users\Admin\AppData\Local\Temp\91725855b62b4a8e6fdb576a1a4f8930N.exe
"C:\Users\Admin\AppData\Local\Temp\91725855b62b4a8e6fdb576a1a4f8930N.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1840
- C:\Users\Admin\AppData\Local\Temp\_choco.exe
  "_choco.exe"
  2⤵
  - Executes dropped EXE
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
76KB

MD5
dae28563e32b5c25c6f9a51117fc3816

SHA1
804115a503e1a1b9d09cfde8171072217a35ab77

SHA256
8a30ee9c65d475ae16bea2c7f9c6c30f45232ecdd4df0c1f52a95c465cdd22f6

SHA512
df3345b2143222fa6bc889a811288c3572eba4d1c6ea9a5058f702ba8c5a24b6c0e1c491269cc6de4948300d05462a4a0f1b8be3013a5685e125294b4e0c2804

Download Submit
C:\Users\Admin\AppData\Local\Temp\_choco.exe

Filesize
142KB

MD5
81a7c181639679983efb07c2dea2ebd0

SHA1
93370e8e5cb0d89bf6786445f94dd02dbb84b574

SHA256
8320c7f90f65b48e4031b680506a9579751789ded4d90fa2fbfc2fb7db7e3ec8

SHA512
599cca13e527c92cdf88df06ed8a01eee1bc602c565ab69e251f7414e19833ce42f0453771bfdf27d16f9f70112835b599d26a6ed92901fdf86bbdf8adf4d2f7

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
76KB

MD5
e548decc1323de0d36504da48b7f3047

SHA1
075634b367df5a677f8521ff94037c0ac99ce227

SHA256
264562604ef29dd72af54be9668476892fc830ae9971cd986621f2ee566d6785

SHA512
bbbaaf46632a3a65b0e66d3519ef678e9bd588c818a0c084603cd794c651fd503ee4414ee35442c297381730481c022068180c19051f3599eaf47431020a1eb6

Download Submit
memory/3068-19-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

Filesize
4KB

Download
memory/3068-20-0x0000000000A60000-0x0000000000A88000-memory.dmp

Filesize
160KB

Download