7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe
Size

549KB
MD5

59f783e86b9b31bab93e088d89dec539
SHA1

ccf3218db99c6a1683ad18e071609ad3e78d1f77
SHA256

7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db
SHA512

8d0621c33e69f37674e9006c9b7145bf8ca913772a5cf488def709d77fb42a95aa9224a3a4b886dd7ba800208a3bf9456f6cb5d55589f63e74654094b4c560d0
SSDEEP

12288:vvbxYX7ZiymOcB+pwPprnVmLmDsC+FU+ZOSzDBtzY7UWfR2p:nLOsDFncLmKDZOSz1FO5w

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (5019) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 3 IoCs

pid	Process
1444	Zombie.exe
228	_vcredist_x86.exe
2768	_vcredist_x86.exe

Loads dropped DLL 1 IoCs

pid	Process
2768	_vcredist_x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Security.Cryptography.Pkcs.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-synch-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusMSDNR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\XLSLICER.DLL.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xalan.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.DriveInfo.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-localization-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\mecontrol.png.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ProviderShared.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InkDiv.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_KMS_Client_AE-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART1.BDR.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.DispatchProxy.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\UIAutomationClientSideProviders.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\ms.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\wsdetect.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_it.properties.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PPINTL.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Quic.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Serialization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Grace-ppd.xrm-ms.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1444	1664	7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe	84
PID 1664 wrote to memory of 1444	1664	7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe	84
PID 1664 wrote to memory of 1444	1664	7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe	84
PID 1664 wrote to memory of 228	1664	7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe	85
PID 1664 wrote to memory of 228	1664	7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe	85
PID 1664 wrote to memory of 228	1664	7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe	85
PID 228 wrote to memory of 2768	228	_vcredist_x86.exe	86
PID 228 wrote to memory of 2768	228	_vcredist_x86.exe	86
PID 228 wrote to memory of 2768	228	_vcredist_x86.exe	86

C:\Users\Admin\AppData\Local\Temp\7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe
"C:\Users\Admin\AppData\Local\Temp\7afea8b1228d1b27fd21eb796681e8dc5b54afd3ea6be76d4dbc46c10a9486db.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1444
- C:\Users\Admin\AppData\Local\Temp\_vcredist_x86.exe
  "_vcredist_x86.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Users\Admin\AppData\Local\Temp\_vcredist_x86.exe
    "C:\Users\Admin\AppData\Local\Temp\_vcredist_x86.exe" -burn.unelevated BurnPipe.{F065E166-322C-4BFB-B904-CC72ED68CF80} {E67E2647-1745-48FD-92BC-F15CC2BC51D0} 228
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1176886754-713327781-2233697964-1000\desktop.ini.exe

Filesize
99KB

MD5
23a18aa0a9592cfb4d234a3542d41c00

SHA1
68ca729917cbfd485c9d79ff614dc9e0414ee029

SHA256
092835206e73ee2a07ea69284d7e13fcecddd7d40c0575b8dc3cebcf65a36f31

SHA512
5323640b04778f5990c84ea657ec73d01e5e687212d6ea1a38860fd5f182bb8e2984e2b10b63bcff8563d4f484e911ca8f630b7a104d876b84efcbfcb984fa58

Download Submit
C:\Users\Admin\AppData\Local\Temp\_vcredist_x86.exe

Filesize
450KB

MD5
2335ab0c0e19c0ef416d07df66fee649

SHA1
1e8794aff453f7647a6c149f3d38f7a3ff4ccd1b

SHA256
f0e46c0f9b2991fa6d187c6b2bed28139c67804cc58cc45c77f06a6f217cb21a

SHA512
518580d7a0d8f9610c8ec0204ae879a91a24325fb5e45348e6f0769aa25a69525992bc0f722df113993aa29a1a917de8fbecfb39d547d6f25354c3488bf06a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\logo.png

Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{f65db027-aff3-4070-886a-0d87064aabb1}\.ba1\wixstdba.dll

Filesize
117KB

MD5
a52e5220efb60813b31a82d101a97dcb

SHA1
56e16e4df0944cb07e73a01301886644f062d79b

SHA256
e7c8e7edd9112137895820e789baaaeca41626b01fb99fede82968ddb66d02cf

SHA512
d6565ba18b5b9795d6bde3ef94d8f7cd77bf8bb69ba3fe7adefb80fc7c5d888cdfdc79238d86a0839846aea4a1e51fc0caed3d62f7054885e8b15fad9f6c654e

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
98KB

MD5
87e049763d5520b546f9042207c41f58

SHA1
0893329160692cb00a77f50eb13f2700225cd9eb

SHA256
e7d28262f029390d40abaf9542523a4991010e9b51d36d6036201cd67af9652e

SHA512
ce157fd3228851e1c95ad8d6e696b993f61e6973d9b482dd7275ad9df4f1ad0ea005d17e24faa79346b68738c45da32d29fbec452f1a321c64f24860e9e1a65f

Download Submit