9797044a9d8d97835b9f4c9cbcbe323d632d3352b3b95e33d266a3b5ede91998

General

Target

7d461dbaf313eb6205de1d31ec211780N.exe
Size

251KB
MD5

7d461dbaf313eb6205de1d31ec211780
SHA1

5942ef9b2cafa28423f1f7fff4409b14eb7f622b
SHA256

9797044a9d8d97835b9f4c9cbcbe323d632d3352b3b95e33d266a3b5ede91998
SHA512

c7f543f34f8814eec0e5fb69d0cab05d61324d867d522ea7cd00d7c16b27a1f256a9f18241de2608f7c9d26f60be7290d947c17f3a1b356b563a0b5fcf26cd38
SSDEEP

3072:6e7Wp1He7Wp1SfWVP2ZQfq6Tl7j66sfmTk3WdK1U:RqGquWVWQVm6S3WYU

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (1462) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Executes dropped EXE 1 IoCs

Processes:

Zombie.exe

pid process

3940 Zombie.exe

pid	process
3940	Zombie.exe

Drops file in System32 directory 2 IoCs

Processes:

7d461dbaf313eb6205de1d31ec211780N.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	7d461dbaf313eb6205de1d31ec211780N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	7d461dbaf313eb6205de1d31ec211780N.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\msinfo32.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\cy.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\WindowsFormsIntegration.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Security.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.CodePages.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.VisualBasic.Forms.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebProxy.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVScripting.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\IpsMigrationPlugin.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Json.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.UnmanagedMemoryStream.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Cryptography.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.Principal.Windows.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClient.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InputPersonalization.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasqlr.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemCore.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabIpsps.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\msdasqlr.dll.mui.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7d461dbaf313eb6205de1d31ec211780N.exeZombie.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d461dbaf313eb6205de1d31ec211780N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7d461dbaf313eb6205de1d31ec211780N.exe

description	pid	process	target process
PID 4752 wrote to memory of 3940	4752	7d461dbaf313eb6205de1d31ec211780N.exe	Zombie.exe
PID 4752 wrote to memory of 3940	4752	7d461dbaf313eb6205de1d31ec211780N.exe	Zombie.exe
PID 4752 wrote to memory of 3940	4752	7d461dbaf313eb6205de1d31ec211780N.exe	Zombie.exe

C:\Users\Admin\AppData\Local\Temp\7d461dbaf313eb6205de1d31ec211780N.exe
"C:\Users\Admin\AppData\Local\Temp\7d461dbaf313eb6205de1d31ec211780N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4752

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2636447293-1148739154-93880854-1000\desktop.ini.exe

Filesize
146KB

MD5
ca9462fedfc7e6927aa04cfae8f22c43

SHA1
689f2d0dd4ecfa9408db5a17bf0b032da851e2cf

SHA256
0a50f156f9bf25cd508e01db1bedc38cbbe3215b1621e4c3a0b89628ef96a353

SHA512
3b009dbeaca97de52b3fdca2884f8627a9971ca758863cdd4c17fdfea1e3913f442e919a08680af6ff37009f9deb580d0b83b4a8bb35dded1eec3097208869f6

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
146KB

MD5
22214090750389285406b6ea32000e3f

SHA1
251b16a5c921129dc9753a691fda7ccfb2a7599e

SHA256
470afd4d3593cd0355e206486a0aca56bf521d728adbdb1c99b18c6bb9248d3e

SHA512
bceeab2c2b00341c3a54311f704d0ce7838aaa8eb0aae6a56b8480b8acf87f058a3be79dffce0d64730f5f730a1bdcb86795bc6692bf4de1ee4c0cf32d90f04a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads