fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86

General

Target

fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe
Size

71KB
MD5

6952ad22ef76157f1de89f20641cf5e8
SHA1

d5faf7f9c4a4130578060703e08e89e06d3da850
SHA256

fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86
SHA512

b8bdb1de128030d3049156850aa12c63cd3b53357729fd5efb9dcb048b9f9370783b7d79e7d9741d7bf3cb7f4ad6ca6f505248610892b064e4fa5ad4257fb7a8
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8xJJMJJ5Jb1JbeZP7iNpW0/137qSez/x:KQSoLpW0/5Zebx

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3689) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/788-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
\Windows\SysWOW64\Zombie.exe	UPX
behavioral1/memory/2272-17-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp	UPX
behavioral1/memory/788-96-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

Executes dropped EXE 2 IoCs

Processes:

_MofCompiler.exeZombie.exe

pid process

1584 _MofCompiler.exe
2272 Zombie.exe

pid	process
1584	_MofCompiler.exe
2272	Zombie.exe

Loads dropped DLL 3 IoCs

Processes:

fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe

pid	process
788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe
788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe
788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/788-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
\Windows\SysWOW64\Zombie.exe	upx
behavioral1/memory/2272-17-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp	upx
behavioral1/memory/788-96-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_scene.wmv.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libGLESv2.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-api-caching.xml.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\vlc.mo.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdxva2_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\7.png.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Easter.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\skins\winamp2.xml.tmp	Zombie.exe
File created	C:\Program Files\Windows Mail\ja-JP\msoeres.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\gadget.xml.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\server\jvm.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Sofia.tmp	Zombie.exe
File created	C:\Program Files\Windows Mail\WinMail.exe.tmp	Zombie.exe
File created	C:\Program Files\Windows Media Player\es-ES\WMPMediaSharing.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\th.txt.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_default_winxp_blu.css.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\Mozilla Firefox\ipcclientcerts.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)alertIcon.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives_1.1.100.v20140523-0116.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Defender\MSASCui.exe.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\Filters.xml.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-autoupdate-ui.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\en-US\bckgRes.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\jquery.jstree.js.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libwall_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\de-DE\Sidebar.exe.mui.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_h.png.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_m.png.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.nl_zh_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench.nl_ja_4.4.0.v20140623020002.jar.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-services.xml.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ChkrRes.dll.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\librotate_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\settings.js.tmp	Zombie.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\adobepdf.xdc.tmp	Zombie.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat.tmp	Zombie.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	Zombie.exe
File created	C:\Program Files\Common Files\System\msadc\adcvbs.inc.tmp	Zombie.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\WhiteDot.png.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.bfc.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia.tmp	Zombie.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe.tmp	Zombie.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwasapi_plugin.dll.tmp	Zombie.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPMediaSharing.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\init.js.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe_MofCompiler.exe

description	pid	process	target process
PID 788 wrote to memory of 1584	788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	_MofCompiler.exe
PID 788 wrote to memory of 1584	788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	_MofCompiler.exe
PID 788 wrote to memory of 1584	788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	_MofCompiler.exe
PID 788 wrote to memory of 1584	788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	_MofCompiler.exe
PID 788 wrote to memory of 2272	788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	Zombie.exe
PID 788 wrote to memory of 2272	788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	Zombie.exe
PID 788 wrote to memory of 2272	788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	Zombie.exe
PID 788 wrote to memory of 2272	788	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	Zombie.exe
PID 1584 wrote to memory of 2756	1584	_MofCompiler.exe	WerFault.exe
PID 1584 wrote to memory of 2756	1584	_MofCompiler.exe	WerFault.exe
PID 1584 wrote to memory of 2756	1584	_MofCompiler.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe
"C:\Users\Admin\AppData\Local\Temp\fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\_MofCompiler.exe
"_MofCompiler.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1584 -s 512
3⤵
PID:2756

C:\Windows\SysWOW64\Zombie.exe
"C:\Windows\system32\Zombie.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2272

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp
Filesize
50KB

MD5
7d3e37c54265f8ceee17834701cdd6b9

SHA1
28e3d17c97b778038af22792af1e4a68b041f198

SHA256
a427f8579fc7c94497d4c1c77e9b648c81802f57ae2faca18bc54779874add29

SHA512
453ee83a8f6a65902301607c8ff020c36b381c00164a425b6be4e0046935efe6ac57477839d6eb9dbe205546a7bc11bdcae4be8515020792c5df03d091fca5ba

Download Submit
\Users\Admin\AppData\Local\Temp\_MofCompiler.exe
Filesize
21KB

MD5
0fe6e0e01318f2a27ece0176423ea4f8

SHA1
71cf6aaa4a88a2e892ce113fe35518441a58a97d

SHA256
36217b7c4ac6aabc74a7f9d0d8da2002f5909d1d6dcb663c9cb1ec2c02a387b3

SHA512
56be67fcf76f46a171c0ebcaa988e1e20cdba5fa91871e076b424b0b9bdd21219a19ca70c85314e5a79c1f878b7f68d7e51596b49536296e41ded5846158ac9b

Download Submit
\Windows\SysWOW64\Zombie.exe
Filesize
49KB

MD5
f4ed1439274abef7222868aa4420d031

SHA1
c5648a9a172be891090ad26b79ca5c2a394a393c

SHA256
f89b62afbb579e50328a166fa10b2174d8f8c258854bd3558c25d0dd6a48d2aa

SHA512
c71037f49ef399a757e7c5d62cb9212c3f02bd44924f93b236fc1d1f0a253fec9426b73f8d962a3aca0e3570d4d17c5f6ea171e8efdc9f3f8862fa43e40efb49

Download Submit
memory/788-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/788-16-0x00000000002A0000-0x00000000002AA000-memory.dmp

Filesize
40KB

Download
memory/788-96-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/788-462-0x00000000002A0000-0x00000000002AA000-memory.dmp

Filesize
40KB

Download
memory/1584-22-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/1584-23-0x00000000001C0000-0x00000000001CA000-memory.dmp

Filesize
40KB

Download
memory/2272-17-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads