Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2024 21:47
Static task
static1
Behavioral task
behavioral1
Sample
4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe
Resource
win10v2004-20240709-en
General
-
Target
4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe
-
Size
220KB
-
MD5
c081629b0b8f89a3af3f84c9fe1d9de8
-
SHA1
bdb1701ac91ca314c70805d5714b7edc24d226d7
-
SHA256
4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96
-
SHA512
9d38e82b7d1c9f282451b45eeb7f629067a4954684434d1b53466854b1a78c3e747fc0c7c69c578adf64543e5ca31c39e295a3817493b6cd13c2d09e6dd0688b
-
SSDEEP
3072:6+WpDfmRfmhz7RjnI52UhCMD98HpKI6GCLOwstyhZFChcssc56FUrgxvbSD4UQr0:wl7+EUhCw9GpKbShcHUak
Malware Config
Signatures
-
Renames multiple (1808) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 2080 Zombie.exe 2996 _choco.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.VisualBasic.Forms.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\UIAutomationClientSideProviders.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.Overlapped.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\va.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.AppContext.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.FileSystem.Watcher.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\ado\msador15.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Xaml.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\7z.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ka.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\msinfo32.exe.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\rtscom.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Principal.Windows.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.ThreadPool.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.ServicePoint.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\rtscom.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Claims.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\cs.pak.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\sk-SK\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.CodePages.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemCore.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\be.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscordaccore_amd64_amd64_7.0.1624.6629.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ku.txt.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\sqlxmlx.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Quic.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\WindowsBase.resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationTypes.dll.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\ms.txt.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msdaprsr.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.ReaderWriter.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\bg.pak.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebClient.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2080 2632 4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe 87 PID 2632 wrote to memory of 2080 2632 4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe 87 PID 2632 wrote to memory of 2080 2632 4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe 87 PID 2632 wrote to memory of 2996 2632 4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe 88 PID 2632 wrote to memory of 2996 2632 4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe"C:\Users\Admin\AppData\Local\Temp\4779e6ebc64484bd3b39356b7ef8f825a417129107822eed5049cb2848ba7e96.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\_choco.exe"_choco.exe"2⤵
- Executes dropped EXE
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5d4b9815c4b2507d20443327c6fd2550e
SHA14ec5924676b7c83e667b1663e8d59657b46f75c7
SHA256f8e99ece0e7007d8a511fded875ff4390e8a7cf5cab0723d0ac078393d0840c1
SHA512399599b1966400e989585bb15a5e4fde3ce6856baa453827746c5ebfdab16b5e66021fb6ec2f16bd805ec0f438c087e93f1483be40cfacbc04fa13f095261717
-
Filesize
142KB
MD581a7c181639679983efb07c2dea2ebd0
SHA193370e8e5cb0d89bf6786445f94dd02dbb84b574
SHA2568320c7f90f65b48e4031b680506a9579751789ded4d90fa2fbfc2fb7db7e3ec8
SHA512599cca13e527c92cdf88df06ed8a01eee1bc602c565ab69e251f7414e19833ce42f0453771bfdf27d16f9f70112835b599d26a6ed92901fdf86bbdf8adf4d2f7
-
Filesize
78KB
MD545f9aea3ddc41820597c24315bb0dd3d
SHA1b07a48f75b7e648ec62696f2ab68e5efb40e47e9
SHA2563c002fe87bdfcf60dd59b69023cbd3ccd4de1ea41144cc37fcb51955d7b5ac1f
SHA512f6199a5c8fb6a3d304518df3cf73e03d2ed8cb34b8b4798e7262c38cdd44e4c90b5c2e91d96bb4966df3806bac2536b94be262d8a3113ec725ce8991ad5222c7