Overview

overview

9

Static

static

3

5291489937...d3.exe

windows7-x64

9

5291489937...d3.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    08/08/2024, 21:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5291489937f8112d867a7e9ce3cafccf43060530f6f5ba82d94adb1f011a7fd3.exe

  • Size

    240KB

  • MD5

    2a8c32c0fe6239a60a5cfc2961a8b432

  • SHA1

    f72c83cc12451e72760f1d4bdbc6479fd68ee74a

  • SHA256

    5291489937f8112d867a7e9ce3cafccf43060530f6f5ba82d94adb1f011a7fd3

  • SHA512

    7732467cd3a649e9f2d36bfae5faab59cc188729e7a4fb26ae880b9e4d3cfbe096df77e6e70c93a10deb8ddc670f2c595e78b8dc7e3a1ec9ec0e955d73ed43af

  • SSDEEP

    1536:W7ZhA7pApEJJMbu+r1uiq6JVlyEjpgL6Bc3mH20McbXYzGmQTLgaC/80EF4Cyv6Q:6e7WpiJMFrfq6Tl7j66sfmTk3WdK1f

Score
9/10
discoveryransomware

Malware Config

Signatures

  • Renames multiple (3452) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5291489937f8112d867a7e9ce3cafccf43060530f6f5ba82d94adb1f011a7fd3.exe
    "C:\Users\Admin\AppData\Local\Temp\5291489937f8112d867a7e9ce3cafccf43060530f6f5ba82d94adb1f011a7fd3.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:2096

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2172136094-3310281978-782691160-1000\desktop.ini.tmp
    Filesize

    134KB

    MD5

    8b6da92944dcd09fa9eb8a82e353ffca

    SHA1

    72d48f25d3fe98ea46aff7c9f3538a530e3d0d91

    SHA256

    5a7661a0f265a984761aa160a471677391f9df9931cc635f86f63d24c35df809

    SHA512

    53a20d4443039423a9443fb92a3de41433bacb5814f4b350dac8bfd897ed57df626649d74732b2927d7514d5e2c7291b3d5b649a72b874057930fd3cfb9cc2ba

    Download Submit

  • C:\Windows\SysWOW64\Zombie.exe
    Filesize

    134KB

    MD5

    2f78c85982a8f54b6b58e308e793cfad

    SHA1

    868e01b920a33c584a056f82be0d78af44a0bc89

    SHA256

    15337d395932001913a3b7be7f0ee61745f4e3870b020c95b1c3d226508fd527

    SHA512

    6c902e930bbeb715327da09cb34c7fea6bc6d86c05901e1c0a6c0de25bd130b744e34adf7b47cb95c9dd91b45b11bf9ac1ab1eb8c0543c232dec27a4b5bfc960

    Download Submit