Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
07/02/2026, 00:01
General
- Target file.exe
- Size 5.8MB
- Sample260207-aa2pjagy7d
- SHA256 a205f794058c59a19322debb1e96a6133ebbab01cb57ae159c2ddb3c7e97a922
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://i.imgur.com/vu5qS42.png
Extracted
Path
-
C:\Decryption Instructions.txt
Ransom Note
- ---------- Zero Day Locker ---------- Your files have been encrypted using Zero Day Ransomware! They can only be decrypted by paying us a ransom in cryptocurrency. Encrypted files have the .zeroday extension. IMPORTANT: Do not modify or rename encrypted files, as they may become unrecoverable. Contact us at the following telegram contact to discuss payment. .me/praiukiu6 ---------- ZeroDayLocker ----------
Signatures
- Renames multiple (188) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://i.imgur.com/vu5qS42.png', 'C:\Users\Admin\AppData\Local\Temp\Wallpaper.png')"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); public static void Set(string path) { SystemParametersInfo(20, 0, path, 3); } }'; [Wallpaper]::Set('C:\Users\Admin\AppData\Local\Temp\Wallpaper.png')"2⤵
- Command and Scripting Interpreter: PowerShell
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fcdsupzo\fcdsupzo.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBB5C.tmp" "c:\Users\Admin\AppData\Local\Temp\fcdsupzo\CSC880D1D112264A1E9B201965B18AA48E.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Decryption Instructions.txt
powershell.exe.log
StartupProfileData-NonInteractive
RESBB5C.tmp
__PSScriptPolicyTest_ktcmy14y.2v2.ps1
fcdsupzo.dll
CSC880D1D112264A1E9B201965B18AA48E.TMP
fcdsupzo.0.cs
fcdsupzo.cmdline
memory/1652-1128-0x00000264FD370000-0x00000264FD392000-memory.dmp
memory/1652-1127-0x00000264FD610000-0x00000264FD620000-memory.dmp
memory/1864-1140-0x00000193A4220000-0x00000193A4230000-memory.dmp
memory/1864-1161-0x00000193BD3B0000-0x00000193BD3B8000-memory.dmp