fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86

General

Target

fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe
Size

71KB
MD5

6952ad22ef76157f1de89f20641cf5e8
SHA1

d5faf7f9c4a4130578060703e08e89e06d3da850
SHA256

fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86
SHA512

b8bdb1de128030d3049156850aa12c63cd3b53357729fd5efb9dcb048b9f9370783b7d79e7d9741d7bf3cb7f4ad6ca6f505248610892b064e4fa5ad4257fb7a8
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8xJJMJJ5Jb1JbeZP7iNpW0/137qSez/x:KQSoLpW0/5Zebx

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1336-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\Windows\SysWOW64\Zombie.exe	UPX
behavioral2/memory/4960-15-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe	UPX

Executes dropped EXE 2 IoCs

Processes:

_MofCompiler.exeZombie.exe

pid process

2144 _MofCompiler.exe
4960 Zombie.exe

pid	process
2144	_MofCompiler.exe
4960	Zombie.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1336-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\Windows\SysWOW64\Zombie.exe	upx
behavioral2/memory/4960-15-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe	upx

Drops file in System32 directory 2 IoCs

Processes:

fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Zombie.exe	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe
File opened for modification	C:\Windows\SysWOW64\Zombie.exe	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe

Drops file in Program Files directory 64 IoCs

Processes:

Zombie.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Excel.Common.FrontEnd.XmlSerializers.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Xaml.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_PrepidBypass-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-conio-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Primitives.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Drawing.Design.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\jsse.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-file-l1-2-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-processthreads-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorrc.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Diagnostics.TraceSource.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Serialization.Formatters.dll.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-core-memory-l1-1-0.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\psfontj2d.properties.tmp	Zombie.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\UIAutomationClientSideProviders.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Extensions.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial2-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	Zombie.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\WidevineCdm\manifest.json.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-ppd.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\sunpkcs11.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\pkcs11cryptotoken.md.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_KMS_ClientC2R-ul.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\bin\zip.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription4-ul-oob.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\PowerPivotExcelClientAddIn.tlb.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX.tmp	Zombie.exe
File created	C:\Program Files\Java\jre-1.8\lib\ext\localedata.jar.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-pl.xrm-ms.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll.tmp	Zombie.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.it-it.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Runtime.Serialization.Json.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationTypes.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\PresentationUI.resources.dll.tmp	Zombie.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\ReportingServicesNativeClient.dll.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\prnms006.inf.tmp	Zombie.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PEOPLEDATAHANDLER.DLL.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.NETCore.App.runtimeconfig.json.tmp	Zombie.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\Microsoft.VisualBasic.dll.tmp	Zombie.exe
File created	C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui.tmp	Zombie.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe

description	pid	process	target process
PID 1336 wrote to memory of 4960	1336	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	Zombie.exe
PID 1336 wrote to memory of 4960	1336	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	Zombie.exe
PID 1336 wrote to memory of 4960	1336	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	Zombie.exe
PID 1336 wrote to memory of 2144	1336	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	_MofCompiler.exe
PID 1336 wrote to memory of 2144	1336	fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe	_MofCompiler.exe

C:\Users\Admin\AppData\Local\Temp\fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe
"C:\Users\Admin\AppData\Local\Temp\fcedc0f5571faf281db7fe0f02c8d235977e616057625daefd391399886c7f86.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\_MofCompiler.exe
  "_MofCompiler.exe"
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\SysWOW64\Zombie.exe
  "C:\Windows\system32\Zombie.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe

Filesize
50KB

MD5
66c92a9613239c549a8dde21d736bcab

SHA1
a97c511cb912a609effe69fd353021e362e5da8b

SHA256
67cca8d90cd4c089c62de4dfaf45438a533c33c458ab3770e4fc119f9ea92257

SHA512
29f05cd77e7aae7d2e5ddd47c4b690875116766b6f48b269cbb8283c762a7c19c0ee63ced8b660f930bc685d4e912928e0c9c1c609aca02a33397c0c7202a23f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MofCompiler.exe

Filesize
21KB

MD5
0fe6e0e01318f2a27ece0176423ea4f8

SHA1
71cf6aaa4a88a2e892ce113fe35518441a58a97d

SHA256
36217b7c4ac6aabc74a7f9d0d8da2002f5909d1d6dcb663c9cb1ec2c02a387b3

SHA512
56be67fcf76f46a171c0ebcaa988e1e20cdba5fa91871e076b424b0b9bdd21219a19ca70c85314e5a79c1f878b7f68d7e51596b49536296e41ded5846158ac9b

Download Submit
C:\Windows\SysWOW64\Zombie.exe

Filesize
49KB

MD5
f4ed1439274abef7222868aa4420d031

SHA1
c5648a9a172be891090ad26b79ca5c2a394a393c

SHA256
f89b62afbb579e50328a166fa10b2174d8f8c258854bd3558c25d0dd6a48d2aa

SHA512
c71037f49ef399a757e7c5d62cb9212c3f02bd44924f93b236fc1d1f0a253fec9426b73f8d962a3aca0e3570d4d17c5f6ea171e8efdc9f3f8862fa43e40efb49

Download Submit
memory/1336-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2144-10-0x000001896AE30000-0x000001896AE3A000-memory.dmp

Filesize
40KB

Download
memory/2144-16-0x00007FF8EDF53000-0x00007FF8EDF55000-memory.dmp

Filesize
8KB

Download
memory/4960-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads