Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-10-2024 18:05
Static task
static1
Behavioral task
behavioral1
Sample
7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe
Resource
win10v2004-20241007-en
General
-
Target
7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe
-
Size
221KB
-
MD5
249ec79940a8ade731ccecb1fc8b8c20
-
SHA1
329044bbf54460f19597c690c72911ae7f2645ce
-
SHA256
7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334
-
SHA512
9aec6f9f19e3774cd99d8371fe33770383a9307ca573f48ebae7d892e10a354ceae5a55b2e9ae2022faf17fe358ea910ee18dd9c0e3bc98042f1f9a578842709
-
SSDEEP
3072:6DWp7WCD9u3NTcGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2a:db9KN4ShcHUaa
Malware Config
Signatures
-
Renames multiple (3106) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 3036 _choco.exe 2532 Zombie.exe -
Loads dropped DLL 3 IoCs
pid Process 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_gtk.css.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-javahelp.jar.tmp Zombie.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\es-ES\ChkrRes.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Indiana\Indianapolis.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Bishkek.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_200_percent.pak.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\fontconfig.bfc.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\about.html.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.zh_CN_5.5.0.165303.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp Zombie.exe File created C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.tmp Zombie.exe File created C:\Program Files\UninstallWrite.iso.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\Microsoft.Build.Engine.resources.dll.tmp Zombie.exe File created C:\Program Files\DVD Maker\bod_r.TTF.tmp Zombie.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Kuching.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\cs.txt.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Cairo.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\bin\jsdt.dll.tmp Zombie.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml.tmp Zombie.exe File created C:\Program Files\Java\jre7\bin\jp2iexp.dll.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\HST.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Indian\Kerguelen.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\pop3.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Etc\GMT-12.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.properties.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar.tmp Zombie.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-common_ja.jar.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\America\Winnipeg.tmp Zombie.exe File created C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville.tmp Zombie.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2688 wrote to memory of 3036 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 30 PID 2688 wrote to memory of 3036 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 30 PID 2688 wrote to memory of 3036 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 30 PID 2688 wrote to memory of 3036 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 30 PID 2688 wrote to memory of 2532 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 31 PID 2688 wrote to memory of 2532 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 31 PID 2688 wrote to memory of 2532 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 31 PID 2688 wrote to memory of 2532 2688 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe"C:\Users\Admin\AppData\Local\Temp\7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\_choco.exe"_choco.exe"2⤵
- Executes dropped EXE
PID:3036
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2532
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5af3d2820bb348a8ff9fba3a2d86f6e47
SHA10cb24c03190a9e78a7d4d690af9e0eaebb0672fc
SHA25607d20f92a20007ff46964366323a88ea29b30b6a0185b6bdf6b0030dce851925
SHA51208893ee7dd7c097b7b41f01ec920ecbb4779368e17bae09e248a9f4d7eebaf13abe70c3e590674922f2dab375e4d537a3c135aa52a7742f6124153a72c5b32b7
-
Filesize
80KB
MD56d9405c6b4fdeaa4704def38ad881960
SHA15d7c34bf2c3f5918748f128dc944c00a91041ce2
SHA25614259a361ece3c703114f1f57b4ffbeeea0f5fcdb0ee0d3d276f2c04317e16a5
SHA512c7e4ea45395ea7e6c2dfdca2b3fe3a05c2e64d9f123ce2ebaf7a89281602165718d10f339b33f94f20bbc971e9fdf1aa57950009014aad64ec71b58fc1712d75
-
Filesize
140KB
MD5c258b25b6ec8f09230e272033ad4b2fa
SHA1c4e862d33fe8915818d9e58d428c7324a436f97f
SHA25629f612bb3cc7a9712baaae62b49b0c03a661280b8bf0177b2713a13c016d0b32
SHA51221f7da9bf267f4cb897d9475f8a6f32e6f7e777c3f761b739da4038d44c2786030bc46ab54a8832205d1fb1fe944d7005eb34ddad3700c4c79bcdb932191b90c