File name:

fuck.exe

Full analysis: https://app.any.run/tasks/86ada894-8265-4048-aeac-83151013a916
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: November 28, 2023, 23:55:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

D2A35298F9E8BE4B301F4770D3E13BE5

SHA1:

175974F0907482368ED35DAB39313CCB1796826A

SHA256:

38398244517D2050D0363800FF78FE33C1D7B7985E88F1AF3F8E24C6EAFDE7BF

SSDEEP:

49152:/cXmoia3kGO7MxmlJY6I3VUGMMYjepBxKgKw:qn9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Using BCDEDIT.EXE to modify recovery options

      • cmd.exe (PID: 3452)
      • cmd.exe (PID: 2276)

    • Create files in the Startup directory

      • malaware protection.exe (PID: 1988)
      • malaware protection.exe (PID: 2056)

    • Drops the executable file immediately after the start

      • fuck.exe (PID: 948)

    • Steals credentials from Web Browsers

      • malaware protection.exe (PID: 1988)

    • Deletes shadow copies

      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 644)
      • cmd.exe (PID: 2116)
      • cmd.exe (PID: 2336)

    • Renames files like ransomware

      • malaware protection.exe (PID: 1988)

    • Actions looks like stealing of personal data

      • malaware protection.exe (PID: 1988)
      • malaware protection.exe (PID: 2056)

  • SUSPICIOUS

    • Starts itself from another location

      • fuck.exe (PID: 948)

    • Reads the Internet Settings

      • fuck.exe (PID: 948)
      • malaware protection.exe (PID: 1988)
      • WMIC.exe (PID: 3208)
      • sipnotify.exe (PID: 148)
      • malaware protection.exe (PID: 2056)
      • WMIC.exe (PID: 2172)
      • mmc.exe (PID: 3128)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2204)
      • vds.exe (PID: 2696)
      • wbengine.exe (PID: 3624)

    • Write to the desktop.ini file (may be used to cloak folders)

      • malaware protection.exe (PID: 1988)

    • Starts CMD.EXE for commands execution

      • malaware protection.exe (PID: 1988)
      • malaware protection.exe (PID: 2056)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 148)
      • ctfmon.exe (PID: 1344)

    • Start notepad (likely ransomware note)

      • malaware protection.exe (PID: 1988)
      • malaware protection.exe (PID: 2056)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 148)

    • Reads Microsoft Outlook installation path

      • mmc.exe (PID: 3128)

    • Reads Internet Explorer settings

      • mmc.exe (PID: 3128)

  • INFO

    • Checks supported languages

      • fuck.exe (PID: 948)
      • malaware protection.exe (PID: 1988)
      • IMEKLMG.EXE (PID: 1988)
      • IMEKLMG.EXE (PID: 2012)
      • malaware protection.exe (PID: 2056)
      • wmpnscfg.exe (PID: 2620)
      • wmpnscfg.exe (PID: 2568)

    • Reads the computer name

      • fuck.exe (PID: 948)
      • malaware protection.exe (PID: 1988)
      • IMEKLMG.EXE (PID: 2012)
      • IMEKLMG.EXE (PID: 1988)
      • malaware protection.exe (PID: 2056)
      • wmpnscfg.exe (PID: 2568)
      • wmpnscfg.exe (PID: 2620)

    • Creates files or folders in the user directory

      • fuck.exe (PID: 948)
      • malaware protection.exe (PID: 1988)
      • mmc.exe (PID: 3128)

    • Reads the machine GUID from the registry

      • malaware protection.exe (PID: 1988)
      • wmpnscfg.exe (PID: 2620)
      • wmpnscfg.exe (PID: 2568)
      • malaware protection.exe (PID: 2056)

    • Manual execution by a user

      • IMEKLMG.EXE (PID: 2012)
      • rundll32.exe (PID: 1152)
      • notepad.exe (PID: 2064)
      • malaware protection.exe (PID: 2056)
      • IMEKLMG.EXE (PID: 1988)
      • mmc.exe (PID: 3016)
      • mmc.exe (PID: 3128)
      • wmpnscfg.exe (PID: 2568)
      • wmpnscfg.exe (PID: 2620)

    • Process checks are UAC notifies on

      • IMEKLMG.EXE (PID: 1988)
      • IMEKLMG.EXE (PID: 2012)

    • Create files in a temporary directory

      • malaware protection.exe (PID: 1988)
      • malaware protection.exe (PID: 2056)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 148)

    • Checks proxy server information

      • mmc.exe (PID: 3128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:28 18:15:01+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 2699776
InitializedDataSize: 89088
UninitializedDataSize: -
EntryPoint: 0x29515e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: fuck.exe
LegalCopyright:
OriginalFileName: fuck.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
35
Malicious processes
8
Suspicious processes
3

Behavior graph

Click at the process to see the details
start fuck.exe no specs malaware protection.exe cmd.exe no specs vssadmin.exe no specs vssvc.exe no specs wmic.exe no specs cmd.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs wbadmin.exe no specs wbengine.exe no specs vdsldr.exe no specs vds.exe no specs notepad.exe no specs sipnotify.exe ctfmon.exe no specs imeklmg.exe no specs imeklmg.exe no specs rundll32.exe no specs malaware protection.exe notepad.exe no specs cmd.exe no specs vssadmin.exe no specs wmic.exe no specs cmd.exe no specs bcdedit.exe no specs bcdedit.exe no specs cmd.exe no specs wbadmin.exe no specs notepad.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs mmc.exe no specs mmc.exe

Process information

PID
CMD
Path
Indicators
Parent process
148C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
644"C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quietC:\Windows\System32\cmd.exe—malaware protection.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
948"C:\Users\admin\Desktop\fuck.exe" C:\Users\admin\Desktop\fuck.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
1
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\fuck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1152"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.rapeC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1296"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Roaming\read_it.txtC:\Windows\System32\notepad.exe—malaware protection.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1344C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1988"C:\Users\admin\AppData\Roaming\malaware protection.exe" C:\Users\admin\AppData\Roaming\malaware protection.exe
fuck.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
1073807364
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\malaware protection.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1988"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2012"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
2056"C:\Users\admin\AppData\Roaming\malaware protection.exe" C:\Users\admin\AppData\Roaming\malaware protection.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\malaware protection.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
9 504
Read events
9 419
Write events
76
Delete events
9

Modification events

(PID) Process:(948) fuck.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(948) fuck.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(948) fuck.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(948) fuck.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1988) malaware protection.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1988) malaware protection.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1988) malaware protection.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1988) malaware protection.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3436) bcdedit.exeKey:HKEY_LOCAL_MACHINE\BCD00000000\Objects\{345b46fd-a9f9-11e7-a83c-e8a4f72b1d33}\Elements\16000009
Operation:writeName:Element
Value:
01
(PID) Process:(1988) IMEKLMG.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\IMEJP\14.0
Operation:writeName:SetPreload
Value:
1
Executable files
1
Suspicious files
1
Text files
724
Unknown types
0

Dropped files

PID
Process
Filename
Type
1988malaware protection.exeC:\Users\admin\Desktop\customerssocial.rtftext
MD5:B21CF2DE3F724D6464D7106E713F48DC
SHA256:992DBE364DF36CE49D4C5A24E540AF6999DA0091C1B8557717C61B2614A62F5C
948fuck.exeC:\Users\admin\AppData\Roaming\malaware protection.exeexecutable
MD5:D2A35298F9E8BE4B301F4770D3E13BE5
SHA256:38398244517D2050D0363800FF78FE33C1D7B7985E88F1AF3F8E24C6EAFDE7BF
1988malaware protection.exeC:\Users\admin\Desktop\read_it.txttext
MD5:05AEAD52B75AADCA32DF822E1AC4B4BE
SHA256:9FCA912D57C55520D9C80474691CC6EEF853F293270CEFEA74B972E7D3E5FA5B
1988malaware protection.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\malaware protection.urltext
MD5:C4C6E6C3CAC83C9CEB6EB951E4FBCEB9
SHA256:9DB864F657DC50A3AD9AB373FA90BA0A27B267FA9D746C9A84BAB6F293CA2992
1988malaware protection.exeC:\Users\admin\Desktop\desktop.initext
MD5:795228A2DB213B5EC2C351736CF475F4
SHA256:D665A98C8CEF21A0DC6367736ABDA72259730CC5F08DDA662F217E5DA7A5D522
1988malaware protection.exeC:\Users\admin\Desktop\existingmarch.rtftext
MD5:6C06176165AFB2DD8A40DB1395F6DDCF
SHA256:FE8F62E05311B694E83434081FFACA2337190C16ACBEF6F830BA5D2247838FF4
1988malaware protection.exeC:\Users\admin\Desktop\duringunderstanding.jpg.rapetext
MD5:6F8E0D55F7500C606AB0711599B1A610
SHA256:8FB0C1BF0F653A3FB6DEC50C88256CEDDDC1FC6D85A2DB646BAAE78BE7D3DA24
1988malaware protection.exeC:\Users\admin\Desktop\existingmarch.rtf.rapetext
MD5:6C06176165AFB2DD8A40DB1395F6DDCF
SHA256:FE8F62E05311B694E83434081FFACA2337190C16ACBEF6F830BA5D2247838FF4
1988malaware protection.exeC:\Users\admin\Desktop\customerssocial.rtf.rapetext
MD5:B21CF2DE3F724D6464D7106E713F48DC
SHA256:992DBE364DF36CE49D4C5A24E540AF6999DA0091C1B8557717C61B2614A62F5C
1988malaware protection.exeC:\Users\admin\Desktop\featurepaypal.rtftext
MD5:E60D4147C4F84149404A334B69C3DE0B
SHA256:8AF6DA09BDC3656453468F3928C31739E3E33EE6706732E3076FBBF1810D25AA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
11
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
148
sipnotify.exe
HEAD
200
104.102.39.173:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133456894301710000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1064
svchost.exe
224.0.0.252:5355
—
—
—
unknown
148
sipnotify.exe
104.102.39.173:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown
2800
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 104.102.39.173
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
fuck.exe