Analysis
-
max time kernel
120s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2024 18:05
Static task
static1
Behavioral task
behavioral1
Sample
7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe
Resource
win10v2004-20241007-en
General
-
Target
7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe
-
Size
221KB
-
MD5
249ec79940a8ade731ccecb1fc8b8c20
-
SHA1
329044bbf54460f19597c690c72911ae7f2645ce
-
SHA256
7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334
-
SHA512
9aec6f9f19e3774cd99d8371fe33770383a9307ca573f48ebae7d892e10a354ceae5a55b2e9ae2022faf17fe358ea910ee18dd9c0e3bc98042f1f9a578842709
-
SSDEEP
3072:6DWp7WCD9u3NTcGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2a:db9KN4ShcHUaa
Malware Config
Signatures
-
Renames multiple (4513) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 2 IoCs
pid Process 1584 _choco.exe 60 Zombie.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Microsoft.WindowsDesktop.App.runtimeconfig.json.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome.dll.sig.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Text.Encoding.CodePages.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Grace-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrusash.dat.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Candara.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\dotnet.exe.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\ReachFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\UIAutomationTypes.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTest-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\si.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-multibyte-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationCore.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\TipRes.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Web.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Extensions\external_extensions.json.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Trial-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\dt_shmem.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\java_crw_demo.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\officeinventoryagentfallback.xml.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\AccessRuntimeR_PrepidBypass-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial3-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-100.png.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Milk Glass.eftx.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub_eula.txt.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-errorhandling-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\WindowsFormsIntegration.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Common Files\System\uk-UA\wab32res.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.Linq.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTest-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-100.png.tmp Zombie.exe File created C:\Program Files\7-Zip\Lang\yo.txt.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml.tmp Zombie.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5060 wrote to memory of 1584 5060 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 85 PID 5060 wrote to memory of 1584 5060 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 85 PID 5060 wrote to memory of 60 5060 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 84 PID 5060 wrote to memory of 60 5060 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 84 PID 5060 wrote to memory of 60 5060 7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe"C:\Users\Admin\AppData\Local\Temp\7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:60
-
-
C:\Users\Admin\AppData\Local\Temp\_choco.exe"_choco.exe"2⤵
- Executes dropped EXE
PID:1584
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5bffcb272738559947ceaa62b754ed561
SHA1ae10c4fe4132f6623e49e4f111146a84744a8625
SHA256dfa5cc0eefc7dfce896f92ea7832f928e4b26b9ae8068f4912b4e8ec7f837704
SHA512ca8c30bd01c11c3ffb013c777fc8ccabf4936021a8f1957754da382c2c06ee44521149fa934ed95bca917163f7bcea44ac0329e6caef4fc2fe07d3da1948dcf9
-
Filesize
140KB
MD5c258b25b6ec8f09230e272033ad4b2fa
SHA1c4e862d33fe8915818d9e58d428c7324a436f97f
SHA25629f612bb3cc7a9712baaae62b49b0c03a661280b8bf0177b2713a13c016d0b32
SHA51221f7da9bf267f4cb897d9475f8a6f32e6f7e777c3f761b739da4038d44c2786030bc46ab54a8832205d1fb1fe944d7005eb34ddad3700c4c79bcdb932191b90c
-
Filesize
80KB
MD56d9405c6b4fdeaa4704def38ad881960
SHA15d7c34bf2c3f5918748f128dc944c00a91041ce2
SHA25614259a361ece3c703114f1f57b4ffbeeea0f5fcdb0ee0d3d276f2c04317e16a5
SHA512c7e4ea45395ea7e6c2dfdca2b3fe3a05c2e64d9f123ce2ebaf7a89281602165718d10f339b33f94f20bbc971e9fdf1aa57950009014aad64ec71b58fc1712d75