Overview

overview

9

Static

static

3

71d8447a46...cN.exe

windows7-x64

9

71d8447a46...cN.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    120s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 10:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    71d8447a46847625802b96a825484b54409f27be94c0984c23230e3293cb1d8cN.exe

  • Size

    503KB

  • MD5

    6c7c4c7c9ccc6e64174f676a0af63650

  • SHA1

    6d7645f0fc3c18feca5abe7394ca5d5a7e4f8d02

  • SHA256

    71d8447a46847625802b96a825484b54409f27be94c0984c23230e3293cb1d8c

  • SHA512

    47e151c6db1bbc98e3fd38379749ea21a1462a3bb7983b918b7ec84053ae89a4d6d3c32f9d40047e25438a297d2d0e0e4b608badcfb0bde92a91a4dc61a6e478

  • SSDEEP

    12288:vJ9vGAD+k3HVJ5BDfp4D7/SAOZi+5v4+rcxftn:PJVJ/t4D7/SAOZi+5v48cxfl

Score
9/10
discoveryransomware

Malware Config

Signatures

  • Renames multiple (3066) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71d8447a46847625802b96a825484b54409f27be94c0984c23230e3293cb1d8cN.exe
    "C:\Users\Admin\AppData\Local\Temp\71d8447a46847625802b96a825484b54409f27be94c0984c23230e3293cb1d8cN.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:1440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3434294380-2554721341-1919518612-1000\desktop.ini.tmp
    Filesize

    72KB

    MD5

    73a8e28142a4fd77ad2348c4a4aa5f82

    SHA1

    218859487e38f961aa190701415f811fd7d48329

    SHA256

    6cac78190b7af38a95de39fa7884488dcd477635c9e883a44d97f3caaadbb49f

    SHA512

    40ce3860c2c9948d50d9b1397a8d1dfbd6230cb871a16fecffaa3c8d876486b7ab59707a62019f88404d52b488871778d1d0269bc34a20385336703200c9d1b0

    Download Submit

  • C:\Windows\SysWOW64\Zombie.exe
    Filesize

    72KB

    MD5

    da84294e8c379e37e22f9a5892e50b35

    SHA1

    dd938056f1e3e6172ea9cc63b5d9e1c4110bf646

    SHA256

    8bfd1e3ef6b7e0bf6125bd328c4049df77de859faf9d5b4342f7e28b2f956594

    SHA512

    3fc36bb34635fcf8177990faaee275694d90d4aeed1062c3a4faf0d6fa594482e64b8084c7432e67a19c888eb72b1bd2a663ad68ecf3afaebccda1851fa70844

    Download Submit