Overview

overview

9

Static

static

3

dc595fac0f...3d.exe

windows7-x64

9

dc595fac0f...3d.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    02-08-2024 05:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc595fac0f1658220abac49fe974d78e9017c9176eadffe37562ecf82ea7c23d.exe

  • Size

    383KB

  • MD5

    937ee5646f9f4d5dc09be21099f2e276

  • SHA1

    a914781bca4c2941132274720b7a02d587d8c2d1

  • SHA256

    dc595fac0f1658220abac49fe974d78e9017c9176eadffe37562ecf82ea7c23d

  • SHA512

    0a425791d9dfb85b4877e6cff024e85de1d92fabb8cf8ecfa096ec51d348d33c020793b92231319f27ce9dcf89f286ae7443ed6967d8fc28f54f80060621aa71

  • SSDEEP

    6144:PqFF2Ie+effypW+Dffz1gUZ3sOeNw0VqIJ/uJn9tvq3v3/sSQJw1Tn:iFF2UpW+Dfhg0cvd5JIDvTJw1L

Score
9/10
discoveryransomware

Malware Config

Signatures

  • Renames multiple (3532) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc595fac0f1658220abac49fe974d78e9017c9176eadffe37562ecf82ea7c23d.exe
    "C:\Users\Admin\AppData\Local\Temp\dc595fac0f1658220abac49fe974d78e9017c9176eadffe37562ecf82ea7c23d.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:2776
    • C:\Users\Admin\AppData\Local\Temp\_7z.exe
      "_7z.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3294248377-1418901787-4083263181-1000\desktop.ini.tmp
    Filesize

    99KB

    MD5

    155f9b4d38c3683646f551fe8d57d8c6

    SHA1

    1108f82ad4184aa9a7e4b28d394228ae4aca0157

    SHA256

    f5d86b51bc29eee292d4a3c80a10f8387bce1c424953b9cb93a5248edb1af8f8

    SHA512

    6c49f5dd58d4d51b8bd0f92ed8578487bea212ccf7c142a240636d21af89d2ce52a3dd81ac2d1fa4e5fbebbd74ee544ec364df3e461049b7fa8e8f5e89acf220

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_7z.exe
    Filesize

    284KB

    MD5

    a42b35f975d88c1370a7aff084ee57a7

    SHA1

    bee1408fe0b15f6f719f003e46aee5ec424cf608

    SHA256

    56cc9e7e3767c0cffae8161bf0ad13457487c1b422e2879b897dbd4bab115776

    SHA512

    b92d05515e18277db660118934e70678ee2a3bb66005bad19bb417ffaedb22a63727a5a697ca3ac0f6c48f6f5593ba45ab80f4ebdc0eaed10d80b7af04d45b23

    Download Submit

  • C:\Windows\SysWOW64\Zombie.exe
    Filesize

    99KB

    MD5

    5fa2f6d65d5512be57f380cc53582482

    SHA1

    db3f50b0d4d52b7982067e38f648fe3f3b76603c

    SHA256

    eb4adad2d8b0787ac71f1fea8851e2cce97adde0d254e312fcbdd2151a7e0acb

    SHA512

    e42720eeb882ca1633491535a316c7642581f97f42ae4df92b7b9786ca33e1c5a17d0fb4de4a7ae9e5d99b5575cc092e5076a54c6f8a34709f6beab64160acf6

    Download Submit