f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0

Analysis

max time kernel
150s
max time network
117s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe
Size

90KB
MD5

f8889b4f2c4e37830bcee57ff333d574
SHA1

bf3337cd407460cd43fca9e57c144c4b15735cb1
SHA256

f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0
SHA512

8fd0c97bb0097e11631ba190f2018aa90477e77604a96a2663360b56d2d8b57eafcd0c21e8ccd357e4d1975e1507e0644263174eeafc9135aea74cf4e36e2de4
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8pZP7iNpW0/137qSez/X:fnyiQSofpW0/5ZebX

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3541) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1644-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
\Windows\SysWOW64\Zombie.exe	UPX
behavioral1/memory/1644-10-0x00000000003B0000-0x00000000003BB000-memory.dmp	UPX
behavioral1/memory/2052-17-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp	UPX
behavioral1/memory/1644-180-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

Processes:

_MofCompiler.exeZombie.exe

pid process

2180 _MofCompiler.exe
2052 Zombie.exe

pid	process
2180	_MofCompiler.exe
2052	Zombie.exe

Loads dropped DLL 3 IoCs

Processes:

f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe

pid	process
1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe
1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe
1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1644-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
\Windows\SysWOW64\Zombie.exe	upx
behavioral1/memory/1644-10-0x00000000003B0000-0x00000000003BB000-memory.dmp	upx
behavioral1/memory/2052-17-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp	upx
behavioral1/memory/1644-180-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\feature.properties.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\tipresx.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\bod_r.TTF.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Fortaleza.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cuiaba.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Troll.tmp	Zombie.exe
File created	C:\Program Files\Mozilla Firefox\installation_telemetry.json.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\MST7.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libtospdif_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Belgrade.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Nauru.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\flavormap.properties.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello.tmp	Zombie.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\System.Speech.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\curl.png.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Dublin.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\jfxrt.jar.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_win7.css.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sa.jar.tmp	Zombie.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Winamac.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	Zombie.exe
File created	C:\Program Files\Windows Media Player\en-US\WMPSideShowGadget.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\gadget.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mlp_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libdeinterlace_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\42.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-uisupport.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe.tmp	Zombie.exe
File created	C:\Program Files\SaveRedo.xltx.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libstl_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\slideShow.js.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe_MofCompiler.exe

description	pid	process	target process
PID 1644 wrote to memory of 2180	1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	_MofCompiler.exe
PID 1644 wrote to memory of 2180	1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	_MofCompiler.exe
PID 1644 wrote to memory of 2180	1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	_MofCompiler.exe
PID 1644 wrote to memory of 2180	1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	_MofCompiler.exe
PID 1644 wrote to memory of 2052	1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	Zombie.exe
PID 1644 wrote to memory of 2052	1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	Zombie.exe
PID 1644 wrote to memory of 2052	1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	Zombie.exe
PID 1644 wrote to memory of 2052	1644	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	Zombie.exe
PID 2180 wrote to memory of 2700	2180	_MofCompiler.exe	WerFault.exe
PID 2180 wrote to memory of 2700	2180	_MofCompiler.exe	WerFault.exe
PID 2180 wrote to memory of 2700	2180	_MofCompiler.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe
"C:\Users\Admin\AppData\Local\Temp\f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1644

C:\Users\Admin\AppData\Local\Temp\_MofCompiler.exe
"_MofCompiler.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2180 -s 516
3⤵
PID:2700

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2052

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp
Filesize
68KB

MD5
c5ad639a5022333a3b0eaffd93748c2a

SHA1
fc92e3b6397f48688fdf11f4bd04e9ae3e629134

SHA256
95fac6845bc5094d4c934164692ad843ad8d778c1de5b8f354ab65cd7d3ed2bc

SHA512
e565d9f3470b343b2cf938ff23a8b7c58aee36b691dcd36934e6b54d22489f6ef2da6f4e57ae9a541cd23ad644c49e0a1458d2e2db59c452325fddf7a90cedd5

Download Submit
\Users\Admin\AppData\Local\Temp\_MofCompiler.exe
Filesize
21KB

MD5
0fe6e0e01318f2a27ece0176423ea4f8

SHA1
71cf6aaa4a88a2e892ce113fe35518441a58a97d

SHA256
36217b7c4ac6aabc74a7f9d0d8da2002f5909d1d6dcb663c9cb1ec2c02a387b3

SHA512
56be67fcf76f46a171c0ebcaa988e1e20cdba5fa91871e076b424b0b9bdd21219a19ca70c85314e5a79c1f878b7f68d7e51596b49536296e41ded5846158ac9b

Download Submit
\Windows\SysWOW64\Zombie.exe
Filesize
68KB

MD5
d10446f158ec28738cf8202707a8be58

SHA1
4b9a40d171b88e2efbada1a6cf15fde5386762a7

SHA256
842abe05683d620ef48b1331b54e1fc3b18e32490b9e19c896608e888bc8d802

SHA512
34f21f47e744b37721aa22ca9aacce95d2282664bdfee3662aa02c845a5573899875049b6987b3151dbb7dfe24e5623b195e90f35803690129491363cb914eae

Download Submit
memory/1644-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1644-10-0x00000000003B0000-0x00000000003BB000-memory.dmp

Filesize
44KB

Download
memory/1644-180-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1644-667-0x00000000003B0000-0x00000000003BB000-memory.dmp

Filesize
44KB

Download
memory/2052-17-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2180-18-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/2180-23-0x0000000000280000-0x000000000028A000-memory.dmp

Filesize
40KB

Download
memory/2180-668-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads