Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 04:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe
- Size 120KB
- Sample241114-fatltayjhm
- SHA256 fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7
- MD5 0d97ba622ccdec553460b0869c31ff7e
- SHA1 6bb9b84f713a67c7a051116bf38901a4c0b1d213
- SHA512 2c7378bb4c29ce30af963070a28558815c30c55b1473014a94ec1ebb3351e43ae1a3bd34c52ec8a29392c7fc4b4c0c7bf125b24941e0cbc35d6d73e0192f1dd6
- SSDEEP 1536:W7ZhA7dAynMdyGdy7YRY1tvtv+I8K/XCKCGSqzVY:6e76ynluKtvtv+ufC58q
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (4650) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Executes dropped EXE 2 IoCs
pid Process 3448 _createdump.exe 3452 Zombie.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Zombie.exe fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe File opened for modification C:\Windows\SysWOW64\Zombie.exe fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-environment-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\System.Xaml.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\instrument.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ucrtbase.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.MashupEngine.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-180.png.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\server\jvm.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Retail-ul-oob.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationClient.resources.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-string-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Annotations.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\System.Runtime.InteropServices.RuntimeInformation.dll.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE.POTX.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\C2R32.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\msvcp140.dll.tmp Zombie.exe File created C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\UIAutomationTypes.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ko\System.Windows.Forms.Primitives.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\JitV.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.EventBasedAsync.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_MAKC2R-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\wpfgfx_cor3.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\legal\jdk\joni.md.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ppd.xrm-ms.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Input.Manipulations.resources.dll.tmp Zombie.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp Zombie.exe File created C:\Program Files\Internet Explorer\sqmapi.dll.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-phn.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\offsymxb.ttf.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\PresentationFramework.resources.dll.tmp Zombie.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Controls.Ribbon.resources.dll.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp Zombie.exe File created C:\Program Files\Java\jdk-1.8\README.html.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe.tmp Zombie.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI.tmp Zombie.exe File created C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp Zombie.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Zombie.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1568 wrote to memory of 3448 1568 fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe 83 PID 1568 wrote to memory of 3448 1568 fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe 83 PID 1568 wrote to memory of 3452 1568 fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe 84 PID 1568 wrote to memory of 3452 1568 fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe 84 PID 1568 wrote to memory of 3452 1568 fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe"C:\Users\Admin\AppData\Local\Temp\fdef5d5b65f32f6dc538ce58f9a2a09af43d05e2ec94e2925a6a2d9b73aa3dd7.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\_createdump.exe"_createdump.exe"2⤵
- Executes dropped EXE
PID:3448
-
-
C:\Windows\SysWOW64\Zombie.exe"C:\Windows\system32\Zombie.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-2437139445-1151884604-3026847218-1000\desktop.ini.exe
- Size 64KB
- SHA256 5b9baca11cacd2fa5be83965df5e590f29429fdb7af5bc136948a20c67369a61
- MD5 62cb3133c7778772f50b609e9bfcacea
- SHA1 ff3a64b947d9893ff79db039b45fa29e244c2039
- SHA512 637f88d74a09edae9877bec9f07f366f4daaab904dcbf15753b05fb5eeaea5a58f301a1fb3c8bcab954b036629580a807ae5ad463a65cbb6d3a4a750795a7a06
- SSDEEP 768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKeg:W7ZhA7dAynMdyGdy7YRY1tvtx
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\_createdump.exe
- Size 56KB
- SHA256 5113e7ae92f3a7aebc7f8e363209866d4d743b06a26c67e0886979a56fd3a10d
- MD5 a05b36f6129223951282f9df776761b1
- SHA1 ec87fa41a670cffa5d77f64366fe109278661f2c
- SHA512 38b588b28057994305a3abc37d98770ab7ff905cba6da35e91b2936b99823955fc91b90a23174d53337dd62e320b9bac066b76734bf657de9fad6d37071c70da
- SSDEEP 768:dE2lGZD4TzvPYNWw1Asvvzzv6t0+3eQKyvqjjUJu9zVB:c+I8K/XCKCGSqzV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Zombie.exe
- Size 63KB
- SHA256 8171845db959efc50a2757c36627e100ce9ac500542d3fbb020a4440e40c33f4
- MD5 1be1e2feb9c42f4a93a43cf64f51728f
- SHA1 cb903a4ad039824e41191024a8702b9897dcbd78
- SHA512 a7195c288e83f0d8371539ad71453b2a89cb7dcfd315e6a88f724556126a11d1e0167adeaa52a5726f59c43636b1b8a55341445f1e864d12bd08abd8dceabf8b
- SSDEEP 768:W7BlphA7dASbS7EXBwzEXBw3sgQw58eGkz2rcuesgQw58eGkz2rcu90TKe+0TKev:W7ZhA7dAynMdyGdy7YRY1tvt2
- MD5 SHA1 SHA512 SSDEEP