7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31

Analysis

max time kernel
60s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe
Size

607KB
MD5

31bc95a2577acda7a463b0727cc8e25b
SHA1

2169ea61f0f7f3e07ef1c249184caae15149b996
SHA256

7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31
SHA512

8ec609f65ec901101619d8171bd10c56a2fad3fc22c459288eef4442340e8414b6ec86e2ff784d1c3c6f3f8d31e21718219567921518423e54611e5c7f1fcf23
SSDEEP

6144:KQSolf5uKhbSnHXBMV5jdCBjtsD52dmdLqff86+jVvaYMLOen9Bp1xf2ODuYMyRE:KQtlUVRMstsD5pAfujVvaYML59RIgq

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (1827) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
4460	Zombie.exe
2408	_MpCmdRun.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3176-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000900000002343f-6.dat	upx
behavioral2/files/0x0007000000023442-12.dat	upx
behavioral2/memory/3176-21-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Tasks.Parallel.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.DataSetExtensions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\UIAutomationProvider.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\PresentationFramework-SystemXml.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Security.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Diagnostics.EventLog.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Linq.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.Compression.Brotli.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Text.Encoding.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Formats.Tar.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.CompilerServices.Unsafe.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Text.Encoding.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcer.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.XPath.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Threading.ThreadPool.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Core.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.DiaSymReader.Native.amd64.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.Serialization.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Data.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationProvider.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\Microsoft.VisualBasic.Forms.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\System.Windows.Input.Manipulations.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.FileSystem.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.FileSystem.Primitives.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\PresentationCore.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\UIAutomationClient.resources.dll.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4460	3176	7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe	83
PID 3176 wrote to memory of 4460	3176	7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe	83
PID 3176 wrote to memory of 4460	3176	7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe	83
PID 3176 wrote to memory of 2408	3176	7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe	84
PID 3176 wrote to memory of 2408	3176	7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe	84

C:\Users\Admin\AppData\Local\Temp\7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe
"C:\Users\Admin\AppData\Local\Temp\7ace5670b060a9a389ec1977802c030130bd1d6ee7aa54c13c640e77e8aecf31.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\_MpCmdRun.exe
  "_MpCmdRun.exe"
  2⤵
  - Executes dropped EXE
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-786284298-625481688-3210388970-1000\desktop.ini.exe

Filesize
54KB

MD5
d7fdf065d50625f01d531437fa530bea

SHA1
b1c7e47123042b0aa26df3277d1fd6aaf5f740fa

SHA256
f31c6cf2daefa42e81a54e19c4021af3b69a74e7e2f4b2199bf3864f538f5a95

SHA512
631ce137bce7981c57b96f0196ef842ed56d1834b755872a126192d4e1bdeeaddb9c0f8ce7f738a46e4802104d409614f4b6cb37417b75c17d9fc7490b82d2d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MpCmdRun.exe

Filesize
553KB

MD5
d20b034be63c99803fb9b659d5e08c4f

SHA1
cc6846f52e59a0c84a16fcadca34a8996630a0d2

SHA256
ac9142ef4843eed75a010d6d31386f288757e9bffab9072eeb20c4a16ab5a26b

SHA512
fdf53323a320e39b98c0a0b327437e96dd1d405025b93d8909cd3821dbdec0ef9bc1bec09a6471d31b3f7af07ce587aa450c7bc2da56ce7abfaa6a607bc2b168

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
54KB

MD5
f192d2312c7c07b14716990f9bfe659c

SHA1
dc9c31f8cce47f85499c5e7612240cf6531fd8e7

SHA256
0b7902476fe3271ace16be1d5f157d15c596b1dc4fb770ef1616d89a59576624

SHA512
dc8141a04133946e7000e7e3d495bab9123af7ef543182d955f716494c12c5bda9c756e655e8767281aa4d7194e4879dbcfbb487cc1b9d4a128938e6aa28a7a0

Download Submit
memory/3176-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3176-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download