4d800505df05f4cd72d21a9cfc90d6fc6259b7b348c638dfb8a7266c82bec558

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan.Win32.Zombie.exe
Size

88KB
MD5

61798e88e0f8120b112d44e91a5c5cc0
SHA1

555647d55b2a87a846ff8ded96c9d8463c401895
SHA256

4d800505df05f4cd72d21a9cfc90d6fc6259b7b348c638dfb8a7266c82bec558
SHA512

6e75abc4ea6ac89fc8da550d2d37b6ebff9a07336818d6278b69f7338af5d45bfe45bfa8686c3fb64101097361b3450f5d5ac03976e904f5ecb6d189190b66d1
SSDEEP

1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYgqeG:6e7WpMaxeb0CYJ97lEYNR73e+eGG1qeG

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3150) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\ado\ja-JP\msader15.dll.mui.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Mozilla Firefox\nssckbi.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Page.wmv.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jre7\bin\libxml2.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Wallis.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_TW.properties.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Inuvik.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\micaut.dll.mui.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libugly_resampler_plugin.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jre7\bin\javafx-iio.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\New_York.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libtcp_plugin.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\PresentationCore.resources.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\ui.js.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Sofia.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jre7\lib\alt-rt.jar.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Moncton.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.concurrent_1.1.0.v20130327-1442.jar.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.RunTime.Serialization.Resources.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Goose_Bay.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Microsoft Games\Purble Place\de-DE\PurblePlace.exe.mui.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\AST4ADT.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\bckgRes.dll.mui.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Mozilla Firefox\browser\crashreporter-override.ini.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\controllers.js.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Azores.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationFramework.resources.dll.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\asl-v20.txt.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\MANIFEST.MF.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576black.png.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp	Trojan.Win32.Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ca.pak.tmp	Trojan.Win32.Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Trojan.Win32.Zombie.exe

C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Zombie.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.Win32.Zombie.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
88KB

MD5
5669554bf18ac6f5b443dce077d8536f

SHA1
67db05284f5ef91cb26acbad059dfc6078c88e7c

SHA256
9aef0fa7f2a36a147f34b58d2f7055d533a5c7a7a0c2a057fcbc3b8bcedb10e9

SHA512
cb652d498628d855ddcdb1e01132d97bc346de515426c98cc8fdb979b035d62b7f16152feec9b11c2e9f616a2813abdc982f143e366fe936ebea02c54c30654b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
97KB

MD5
10215585229fb71940d2210e0bb4d7c7

SHA1
b3e9f90817d3731420be3395e633b0ae610239f5

SHA256
a19997d769367c1a76fae994e7bc7cf8cbdca0d5d30290366e574a880cc5ab71

SHA512
9e2feafe3390127da82cde8a8fc5a35adebca198335b21a44ed11b1bf4f9371f5a9843ebe0979d69efc47cd2b5be499be5e7aac845fcfac5cefe63966bca0af0

Download Submit