f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe
Size

90KB
MD5

f8889b4f2c4e37830bcee57ff333d574
SHA1

bf3337cd407460cd43fca9e57c144c4b15735cb1
SHA256

f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0
SHA512

8fd0c97bb0097e11631ba190f2018aa90477e77604a96a2663360b56d2d8b57eafcd0c21e8ccd357e4d1975e1507e0644263174eeafc9135aea74cf4e36e2de4
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8pZP7iNpW0/137qSez/X:fnyiQSofpW0/5ZebX

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (4869) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2424-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\Windows\SysWOW64\Zombie.exe	UPX
behavioral2/memory/4668-13-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.exe	UPX

Executes dropped EXE 2 IoCs

Processes:

_MofCompiler.exeZombie.exe

pid process

2372 _MofCompiler.exe
4668 Zombie.exe

pid	process
2372	_MofCompiler.exe
4668	Zombie.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2424-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\Windows\SysWOW64\Zombie.exe	upx
behavioral2/memory/4668-13-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.exe	upx

Drops file in System32 directory 2 IoCs

Processes:

f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.Http.Json.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\zh-CN.pak.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\security\policy\unlimited\local_policy.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Annotations.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\id.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sk-sk.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.DispatchProxy.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Drawing.Common.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\jawt.h.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.IO.MemoryMappedFiles.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Private.Uri.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\WindowsBase.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\System.Windows.Forms.Design.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\UIAutomationClient.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\WindowsBase.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL002.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Client.Core.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.NetworkInformation.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PenImc_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\net.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssv.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sk\msipc.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL115.XML.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri Light-Constantia.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019MSDNR_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GFX.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Intrinsics.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial2-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\EXCELPLUGINDATAPROVIDER.DLL.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN090.XML.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVManifest.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.WebSockets.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\jfxrt.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\mscss7wre_en.dub.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.FileSystem.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ca.pak.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PREVIEWTEMPLATE2.POTX.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GKPowerPoint.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_F_COL.HXK.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe

description	pid	process	target process
PID 2424 wrote to memory of 2372	2424	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	_MofCompiler.exe
PID 2424 wrote to memory of 2372	2424	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	_MofCompiler.exe
PID 2424 wrote to memory of 4668	2424	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	Zombie.exe
PID 2424 wrote to memory of 4668	2424	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	Zombie.exe
PID 2424 wrote to memory of 4668	2424	f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe	Zombie.exe

C:\Users\Admin\AppData\Local\Temp\f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe
"C:\Users\Admin\AppData\Local\Temp\f254d7335cf66a15a360c3b7fb99eee9bae1cccb070a0a8b4dccb6089663efa0.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2424

C:\Users\Admin\AppData\Local\Temp\_MofCompiler.exe
"_MofCompiler.exe"
2⤵
- Executes dropped EXE
PID:2372

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4668

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.exe
Filesize
68KB

MD5
b3404d79cfec245106e865a9e44418e6

SHA1
bf4805208729c6e55cdef6d6c4e2b420815ca024

SHA256
da962d744b560bef6ac621bfb30119b686808b020653b83ecdc4cf70c70a200e

SHA512
6af966413f3cecde47d4ab4ed3586c8286a5dbdce947f17d3bea8445f72b90646214db327f30840d8b861b353a0300fbc6480e43d9b704e71835086b91cf6ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MofCompiler.exe
Filesize
21KB

MD5
0fe6e0e01318f2a27ece0176423ea4f8

SHA1
71cf6aaa4a88a2e892ce113fe35518441a58a97d

SHA256
36217b7c4ac6aabc74a7f9d0d8da2002f5909d1d6dcb663c9cb1ec2c02a387b3

SHA512
56be67fcf76f46a171c0ebcaa988e1e20cdba5fa91871e076b424b0b9bdd21219a19ca70c85314e5a79c1f878b7f68d7e51596b49536296e41ded5846158ac9b

Download Submit
C:\Windows\SysWOW64\Zombie.exe
Filesize
68KB

MD5
d10446f158ec28738cf8202707a8be58

SHA1
4b9a40d171b88e2efbada1a6cf15fde5386762a7

SHA256
842abe05683d620ef48b1331b54e1fc3b18e32490b9e19c896608e888bc8d802

SHA512
34f21f47e744b37721aa22ca9aacce95d2282664bdfee3662aa02c845a5573899875049b6987b3151dbb7dfe24e5623b195e90f35803690129491363cb914eae

Download Submit
memory/2372-14-0x00007FF85B423000-0x00007FF85B425000-memory.dmp

Filesize
8KB

Download
memory/2372-11-0x0000029C48B20000-0x0000029C48B2A000-memory.dmp

Filesize
40KB

Download
memory/2424-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4668-13-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads