Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 05:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Trojan.Win32.Zombie.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
120 seconds
Behavioral task
behavioral2
Sample
Trojan.Win32.Zombie.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
120 seconds
General
-
Target
Trojan.Win32.Zombie.exe
-
Size
88KB
-
MD5
61798e88e0f8120b112d44e91a5c5cc0
-
SHA1
555647d55b2a87a846ff8ded96c9d8463c401895
-
SHA256
4d800505df05f4cd72d21a9cfc90d6fc6259b7b348c638dfb8a7266c82bec558
-
SHA512
6e75abc4ea6ac89fc8da550d2d37b6ebff9a07336818d6278b69f7338af5d45bfe45bfa8686c3fb64101097361b3450f5d5ac03976e904f5ecb6d189190b66d1
-
SSDEEP
1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+ejy0Wjy0WzYgqeG:6e7WpMaxeb0CYJ97lEYNR73e+eGG1qeG
Score
9/10
Malware Config
Signatures
-
Renames multiple (4568) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\nb.pak.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\javafx.properties.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\PresentationUI.resources.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.Win32.SystemEvents.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ul-phn.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-debug-l1-1-0.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\EXPTOOWS.DLL.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Windows.Forms.resources.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremDemoR_BypassTrial365-ul-oob.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Memory.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Presentation.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GB.XSL.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Trial-ul-oob.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\7-Zip\Lang\sv.txt.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\ReachFramework.resources.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Xaml.resources.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ul-oob.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationProvider.resources.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PenImc_cor3.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Xaml.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\npdeployJava1.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XDocument.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Controls.Ribbon.resources.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.Process.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationFramework.resources.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019DemoR_BypassTrial180-ppd.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\TelemetryDashboard.xltx.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ul-phn.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Windows.Input.Manipulations.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\WindowsBase.resources.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONGRAPHICS.DLL.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\mshwLatin.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ul-oob.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ul-oob.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-core-synch-l1-1-0.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ppd.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\MEDIA\VOLTAGE.WAV.tmp Trojan.Win32.Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp Trojan.Win32.Zombie.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan.Win32.Zombie.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD59fa61b569a27ca5141eadb4dd93f079b
SHA1e1e00fc3e82db8f11128f3060eb0284cb85e7e32
SHA2564bd5ae563b41481574b9136083350eca3953b6cb45135ee66392aafec1d90b66
SHA512d00f8ca6bf9b64d4a7d61afb02bd85c4bada7ce5e90950d3512cb0de83a9cb7f5bd88debb3395f74a442e030d12e3b5674881a7dfaa30fb1e766a6cad06445d0
-
Filesize
187KB
MD59cea051b9cd4a9a1fcc75f9b204737cb
SHA1a8c81744417122ee1c963e590fe1b1937bcfa12a
SHA256c0717f50e7cb7c3253246737cc390a04c18745ee2ef90baebda31a6cdf9a9055
SHA512104fa88315a0b9df2e82dabbe34fd7ce481cbf74eeb81e24a09115f454a25d150d3a12b10ee147d6cb20854c1d9cade373a6335ab69c9dd2532180311059a5b4