Analysis

  • max time kernel
    120s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-10-2024 18:05

General

  • Target

    7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe

  • Size

    221KB

  • MD5

    249ec79940a8ade731ccecb1fc8b8c20

  • SHA1

    329044bbf54460f19597c690c72911ae7f2645ce

  • SHA256

    7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334

  • SHA512

    9aec6f9f19e3774cd99d8371fe33770383a9307ca573f48ebae7d892e10a354ceae5a55b2e9ae2022faf17fe358ea910ee18dd9c0e3bc98042f1f9a578842709

  • SSDEEP

    3072:6DWp7WCD9u3NTcGCLOwstyhZFChcssc56FUrgxvbSD4UQrO2a:db9KN4ShcHUaa

Score
9/10

Malware Config

Signatures

  • Renames multiple (4513) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Executes dropped EXE 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe
    "C:\Users\Admin\AppData\Local\Temp\7766e3d5347c1ff3d3782c083bf8b249437690d6ed2b5e7a9dd45aba817ed334N.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Windows\SysWOW64\Zombie.exe
      "C:\Windows\system32\Zombie.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      PID:60
    • C:\Users\Admin\AppData\Local\Temp\_choco.exe
      "_choco.exe"
      2⤵
      • Executes dropped EXE
      PID:1584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.exe

    Filesize

    81KB

    MD5

    bffcb272738559947ceaa62b754ed561

    SHA1

    ae10c4fe4132f6623e49e4f111146a84744a8625

    SHA256

    dfa5cc0eefc7dfce896f92ea7832f928e4b26b9ae8068f4912b4e8ec7f837704

    SHA512

    ca8c30bd01c11c3ffb013c777fc8ccabf4936021a8f1957754da382c2c06ee44521149fa934ed95bca917163f7bcea44ac0329e6caef4fc2fe07d3da1948dcf9

  • C:\Users\Admin\AppData\Local\Temp\_choco.exe

    Filesize

    140KB

    MD5

    c258b25b6ec8f09230e272033ad4b2fa

    SHA1

    c4e862d33fe8915818d9e58d428c7324a436f97f

    SHA256

    29f612bb3cc7a9712baaae62b49b0c03a661280b8bf0177b2713a13c016d0b32

    SHA512

    21f7da9bf267f4cb897d9475f8a6f32e6f7e777c3f761b739da4038d44c2786030bc46ab54a8832205d1fb1fe944d7005eb34ddad3700c4c79bcdb932191b90c

  • C:\Windows\SysWOW64\Zombie.exe

    Filesize

    80KB

    MD5

    6d9405c6b4fdeaa4704def38ad881960

    SHA1

    5d7c34bf2c3f5918748f128dc944c00a91041ce2

    SHA256

    14259a361ece3c703114f1f57b4ffbeeea0f5fcdb0ee0d3d276f2c04317e16a5

    SHA512

    c7e4ea45395ea7e6c2dfdca2b3fe3a05c2e64d9f123ce2ebaf7a89281602165718d10f339b33f94f20bbc971e9fdf1aa57950009014aad64ec71b58fc1712d75

  • memory/1584-20-0x00007FFD40313000-0x00007FFD40315000-memory.dmp

    Filesize

    8KB

  • memory/1584-19-0x0000000000D60000-0x0000000000D88000-memory.dmp

    Filesize

    160KB