Overview

overview

9

Static

static

7

0f3ce55182...0N.exe

windows7-x64

9

0f3ce55182...0N.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    23/07/2024, 21:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    0f3ce55182f243885b57c8609c212e10N.exe

  • Size

    189KB

  • MD5

    0f3ce55182f243885b57c8609c212e10

  • SHA1

    49ef39d0c34c1b6759e8fe5f27c1c7dd34704876

  • SHA256

    b4d8b0d8a073d4bf8e68e3512dd24aa43ddc891067c62fc5048196555188f98d

  • SHA512

    349d19d54e482e3c39b91329218eab12f0c1e8a61c27ebb956ecbdc1ede78da980aab07be85057ae033143d73f854c8afefdf7a289fbab2ee30491a9d6d04f39

  • SSDEEP

    3072:6Tuf7fs6UMU90HpKOrGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2Ixyi:Tf7fG59OpKgShcHUa2

Score
9/10
discoveryransomwareupx

Malware Config

Signatures

  • Renames multiple (3203) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f3ce55182f243885b57c8609c212e10N.exe
    "C:\Users\Admin\AppData\Local\Temp\0f3ce55182f243885b57c8609c212e10N.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Users\Admin\AppData\Local\Temp\_chocolatey.exe
      "_chocolatey.exe"
      2⤵
      • Executes dropped EXE
      PID:3004
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:2692

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.tmp
          Filesize

          46KB

          MD5

          e635873a4d458c94ae5d8b4e2553f465

          SHA1

          7ce53c9c906f06ffba385836acd4620338500578

          SHA256

          f58537e8109f24b6937f9ab93383bde836b00d6a7407ca5acefafd850d70910e

          SHA512

          9d768f4f36593d15a09d8e24862a1e6a2c40879402650e9c382d41a2b54d0fad5e2f6a8746102def5e9b3072a1b0121753777ca7432b4a1966c8d41283e777f8

          Download Submit

        • \Users\Admin\AppData\Local\Temp\_chocolatey.exe
          Filesize

          143KB

          MD5

          c583d768336377e263ed3de978da7c6e

          SHA1

          2c48977d57dfe983781ae622056588233d7d67ee

          SHA256

          54836a96884e0e9b30b1ff5b3ece61ce17dd472a4b09137296cd7915ec4a0fac

          SHA512

          284adabd0b025057d4f43e860b9cb64fd9505439c658cf011b87fcce5b15c6d6ebeae1134373c48401b559bdb465e882798127edb7c0fbbba59f225f85150b93

          Download Submit

        • \Windows\SysWOW64\Zombie.exe
          Filesize

          46KB

          MD5

          6050bc6267797378f3368945423c3756

          SHA1

          c6f4d97502de1532beea4e3302527448b592df50

          SHA256

          8b9cf1ec50779d5a225dec92ce60996e29515e8af2ef1d87349778a80279fa5f

          SHA512

          f620f6a45e95b75c185673f5db145cd70a3b86fd8d931d1cc4c8cdb778724fd747cc1b7d50dc196b71ebf132493407f86c4f815d40bcd158c92b9732836a8206

          Download Submit

        • memory/2692-18-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2716-0-0x0000000000400000-0x000000000040A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2716-15-0x0000000000270000-0x000000000027A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2716-9-0x0000000000270000-0x000000000027A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/3004-23-0x000007FEF4CA3000-0x000007FEF4CA4000-memory.dmp

          Filesize

          4KB

          Download

        • memory/3004-24-0x0000000000040000-0x0000000000068000-memory.dmp

          Filesize

          160KB

          Download