Analysis

  • max time kernel
    120s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-10-2024 18:05

General

  • Target

    7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe

  • Size

    221KB

  • MD5

    249ec79940a8ade731ccecb1fc8b8c20

  • SHA1

    329044bbf54460f19597c690c72911ae7f2645ce

  • SHA256

    7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334

  • SHA512

    9aec6f9f19e3774cd99d8371fe33770383a9307ca573f48ebae7d892e10a354ceae5a55b2e9ae2022faf17fe358ea910ee18dd9c0e3bc98042f1f9a578842709

  • SSDEEP

    3072:6DWp7WCD9u3NTcGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2a:db9KN4ShcHUaa

Score
9/10

Malware Config

Signatures

  • Renames multiple (3106) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe
    "C:\Users\Admin\AppData\Local\Temp\7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\_choco.exe
      "_choco.exe"
      2⤵
      • Executes dropped EXE
      PID:3036
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:2532

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

    Filesize

    81KB

    MD5

    af3d2820bb348a8ff9fba3a2d86f6e47

    SHA1

    0cb24c03190a9e78a7d4d690af9e0eaebb0672fc

    SHA256

    07d20f92a20007ff46964366323a88ea29b30b6a0185b6bdf6b0030dce851925

    SHA512

    08893ee7dd7c097b7b41f01ec920ecbb4779368e17bae09e248a9f4d7eebaf13abe70c3e590674922f2dab375e4d537a3c135aa52a7742f6124153a72c5b32b7

  • C:\Windows\SysWOW64\Zombie.exe

    Filesize

    80KB

    MD5

    6d9405c6b4fdeaa4704def38ad881960

    SHA1

    5d7c34bf2c3f5918748f128dc944c00a91041ce2

    SHA256

    14259a361ece3c703114f1f57b4ffbeeea0f5fcdb0ee0d3d276f2c04317e16a5

    SHA512

    c7e4ea45395ea7e6c2dfdca2b3fe3a05c2e64d9f123ce2ebaf7a89281602165718d10f339b33f94f20bbc971e9fdf1aa57950009014aad64ec71b58fc1712d75

  • \Users\Admin\AppData\Local\Temp\_choco.exe

    Filesize

    140KB

    MD5

    c258b25b6ec8f09230e272033ad4b2fa

    SHA1

    c4e862d33fe8915818d9e58d428c7324a436f97f

    SHA256

    29f612bb3cc7a9712baaae62b49b0c03a661280b8bf0177b2713a13c016d0b32

    SHA512

    21f7da9bf267f4cb897d9475f8a6f32e6f7e777c3f761b739da4038d44c2786030bc46ab54a8832205d1fb1fe944d7005eb34ddad3700c4c79bcdb932191b90c

  • memory/3036-19-0x000007FEF5B83000-0x000007FEF5B84000-memory.dmp

    Filesize

    4KB

  • memory/3036-20-0x0000000001050000-0x0000000001078000-memory.dmp

    Filesize

    160KB