Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 11:47
Behavioral task
behavioral1
Sample
13e574d6685ff01ccce817e7749a6810N.exe
Resource
win7-20240704-en
windows7-x64
8 signatures
120 seconds
Behavioral task
behavioral2
Sample
13e574d6685ff01ccce817e7749a6810N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
13e574d6685ff01ccce817e7749a6810N.exe
-
Size
94KB
-
MD5
13e574d6685ff01ccce817e7749a6810
-
SHA1
1e59208fa6f94769fd22d37e1256d1b6bcda0c2f
-
SHA256
23af64e12ea1c46c3bae219a2426266297185a3ed1c564d8d64a2b945964ee6e
-
SHA512
c13ad18c12b3e3a9725ff9f9b7ff63f0e4c951aca9fd51637d4c2b6a2381f79d928e17b4319038d1a22291fe68b42c4fe326e88faad024c439312349426e1f51
-
SSDEEP
1536:V7Zf/FAxTWoJJZENTBWv36Gr0ARZF6NFVogjQlRv/Lc:fny1tEevMwUhQ7Xg
Score
9/10
Malware Config
Signatures
-
Renames multiple (4619) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 2616 Zombie.exe 3208 _checksum.exe -
resource yara_rule behavioral2/memory/728-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x000900000002347b-6.dat upx behavioral2/files/0x00070000000234df-12.dat upx behavioral2/memory/728-25-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 13e574d6685ff01ccce817e7749a6810N.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 13e574d6685ff01ccce817e7749a6810N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-process-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\security\blacklist.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_Subscription-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.XLA.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Internet Explorer\iexplore.exe.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\calendars.properties.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-ES\InputPersonalization.exe.mui.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ObjectModel.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-180.png.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.ProtectedData.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_OEM_Perp-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\glib-lite.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\dom.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RInt.16.msi.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\FilterModule.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\amd64\jvm.cfg.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_KMS_Client-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebHeaderCollection.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-rtlsupport-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dt_shmem.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_PrepidBypass-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\deploy\messages_pt_BR.properties.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework-SystemDrawing.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\PresentationFramework.Royale.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Permissions.dll.tmp Zombie.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13e574d6685ff01ccce817e7749a6810N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 728 wrote to memory of 2616 728 13e574d6685ff01ccce817e7749a6810N.exe 85 PID 728 wrote to memory of 2616 728 13e574d6685ff01ccce817e7749a6810N.exe 85 PID 728 wrote to memory of 2616 728 13e574d6685ff01ccce817e7749a6810N.exe 85 PID 728 wrote to memory of 3208 728 13e574d6685ff01ccce817e7749a6810N.exe 86 PID 728 wrote to memory of 3208 728 13e574d6685ff01ccce817e7749a6810N.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\13e574d6685ff01ccce817e7749a6810N.exe"C:\Users\Admin\AppData\Local\Temp\13e574d6685ff01ccce817e7749a6810N.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\_checksum.exe"_checksum.exe"2⤵
- Executes dropped EXE
PID:3208
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5c1fd0ed160081e41da5141ea05c958ad
SHA1aa4736995c7bbb9de2a8f1d507c900bf37c1622f
SHA2566943a27502b98bb5b59f2dea979478b2800102fabdf1142c9a675a235343b5a7
SHA5123691401a17f4b52e4c23c591629674803c3d63ab1758281730e2b6b932a90140027300f8238ba83aa1a62057e222968741aa4ab0086d9a59b52ac1e5778fe610
-
Filesize
35KB
MD523f049f14ca0e68af4b9883514791dfe
SHA11224ecfda221e54d4536a4ac102a56235320ee25
SHA2569562aabe1f71d7ff5ec879fd2fb5cfe4be2c8f62a7fa5a1aa49660c3a495f1fb
SHA512ce91cd089a299ba88f047cf15fd06673389942dabbf8be5bf2e2666e1048bc6da261ce30cae1e2ecb3b50392441a335bf97cc4ed51540554bedabe65590be677
-
Filesize
58KB
MD54566e3d6f2ebcc00a301277a5b2fe6c9
SHA11714f4bfcf9a2f2a7f8bd08151a25fdf0649efc2
SHA25611a9e4402011a909128620ef58301285d228418abee9c33e8998acdb7ee5df43
SHA512b0141eaf9b32a86789c76cd6becc57eaefb00254e4b676d5dd9b2e4eb76a13925ab491491c3c0a35339080d3a3422a6b83c02b32f4bc4c6d40dc92af4031980c