5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984

Analysis

max time kernel
120s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe
Size

214KB
MD5

22af396bd56eb72ac105007340b04710
SHA1

bca77fc1d6184d665cb5dc13898b3fcd5d2f0100
SHA256

5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984
SHA512

d71bfc17aeda53099766c526d1f6f5ad95a86c21a2b19cfc0fffc68fb05e536989174b132e75016fa9207af575017b16acaab46c5d0abada55dd1adfb7b73a60
SSDEEP

3072:KQSox5KwJYvHYvHGU9T3NoFGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2My:KQSox5KwJSHSH/9bN8ShcHUaMy

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (323) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2460	Zombie.exe
2856	_chocolatey.exe

Loads dropped DLL 3 IoCs

pid	Process
2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe
2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe
2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Zombie.exe	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c000000012264-6.dat	upx
behavioral1/files/0x0002000000018334-19.dat	upx
behavioral1/memory/2220-27-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\es-ES\OmdProject.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msador15.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadcf.dll.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\ja-JP\WMM2CLIP.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ml.pak.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.jpg.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprst.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Notes_PAL.wmv.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\bn.pak.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\split.avi.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tabskb.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipBand.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tabskb.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationUp_SelectionSubpicture.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msadcor.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\ado\msado25.tlb.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msdaremr.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\colorcycle.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\CompleteBlock.dotx.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passportcover.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\msdaprsr.dll.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\ru.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\TipTsf.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\external_extensions.json.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\is.txt.tmp	Zombie.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Zombie.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2856	2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe	30
PID 2220 wrote to memory of 2856	2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe	30
PID 2220 wrote to memory of 2856	2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe	30
PID 2220 wrote to memory of 2856	2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe	30
PID 2220 wrote to memory of 2460	2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe	29
PID 2220 wrote to memory of 2460	2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe	29
PID 2220 wrote to memory of 2460	2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe	29
PID 2220 wrote to memory of 2460	2220	5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe	29

C:\Users\Admin\AppData\Local\Temp\5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe
"C:\Users\Admin\AppData\Local\Temp\5e6a3bcb7ae7189a38ccf33c57775bf2cec01caf0d00924e96496d40072ac984N.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:2460
- C:\Users\Admin\AppData\Local\Temp\_chocolatey.exe
  "_chocolatey.exe"
  2⤵
  - Executes dropped EXE
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3692679935-4019334568-335155002-1000\desktop.ini.tmp

Filesize
74KB

MD5
1a83d28280ee4b9ddb273f639a3b8685

SHA1
6e5d1ee8d6389c46daadabe4f188029544aea1e9

SHA256
283d8d00dc4e0485ed85a8b100780bceddb046755583c68068433460042f1a07

SHA512
307210c0e4a3235c6a93d763979459adff334488557fafd73e5239f809f05b21f94f6e9e7b9a6cbd5119a79dd08e2525251d6a7c5641c3ad7f641802e4222411

Download Submit
\Users\Admin\AppData\Local\Temp\_chocolatey.exe

Filesize
140KB

MD5
d6bc92571edfc2863fff72b240e571a1

SHA1
b4227284cde5d9c00c42a043c1c16766b4c6460c

SHA256
422cfcc02baaff218e47cc6463efc5eaafb33ad4d0a920db3432de1f8963c4f8

SHA512
31cdfef64c809d1c1da3fc5dca2aec2fb03b911f3d2e3d010328606479d414363795d6386cc9426f3d494aeb14fb2b75889cdbbddbbeb8f0d8b09020e8404d1d

Download Submit
\Windows\SysWOW64\Zombie.exe

Filesize
74KB

MD5
23a2c1176d5edafb7bc9f2bc8c9c9a5e

SHA1
6b54423fb367d57a8ab8bdd2f5405ea0d675ec2a

SHA256
f5a72dd36ab3c9214a0535666bb0af95afa88ad427491cd0a62be8036c4aa216

SHA512
cf84c68e7194fd511cd56e25829b2517803df6a3b4287011793870af93fd2f3f4a10fb1e476c43960359fbc63e3ed2bdf7883bf8e9c54bf38f7f4a5f9a44bcf2

Download Submit
memory/2220-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2220-14-0x0000000000300000-0x000000000030A000-memory.dmp

Filesize
40KB

Download
memory/2220-13-0x0000000000330000-0x000000000033A000-memory.dmp

Filesize
40KB

Download
memory/2220-27-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2856-22-0x000007FEF5F03000-0x000007FEF5F04000-memory.dmp

Filesize
4KB

Download
memory/2856-23-0x00000000001C0000-0x00000000001E8000-memory.dmp

Filesize
160KB

Download