6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357

General

Target

6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
Size

63KB
MD5

851af2515c3ad972639f5dbab50a410f
SHA1

e2d24a6f0536b8f70a89f41f0f6a080bdea1053f
SHA256

6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357
SHA512

56a6f5a0ba4d10be143f869c28ff0bf41fc12371f1c8a955c79936e90f4d9ba8cd8fc8feaef3a62c492d6f10a3113ec91f9c8beaebc86301ee2468a31d18a0d8
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8E:+nyiQSob

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1027) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1692-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/1692-68-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1692-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/1692-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe

description	ioc	process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\de.pak.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_hu.jar.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Bougainville.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Internet Explorer\JSProfilerCore.dll.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\micaut.dll.mui.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Common Files\System\msadc\msdaremr.dll.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\US_export_policy.jar.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Warsaw.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\7-Zip\Lang\eu.txt.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxml2.dll.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tiptsf.dll.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\desktop.ini.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask.wmv.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047_576black.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Mauritius.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\InputPersonalization.exe.mui.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\micaut.dll.mui.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mip.exe.mui.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Khandyga.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoDev.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Rangoon.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\OmdProject.dll.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub.DataWarehouse.dll.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Internet Explorer\F12.dll.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_ButtonGraphic.png.tmp	6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe

C:\Users\Admin\AppData\Local\Temp\6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe
"C:\Users\Admin\AppData\Local\Temp\6f665708ed745a0e1636c486d396d8afa4cb0ad5f30c5d7b454b2f9b3ff13357.exe"
1⤵
- Drops file in Program Files directory
PID:1692

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp
Filesize
63KB

MD5
c23aa024d91eae55dd7811413d329eca

SHA1
248d4cbfb18e1a63681af8679e7ce48645c844e0

SHA256
e5637cffb3dcefb4e919abcf3b7328296f5d262e08242553c4bc1a34797fd1c2

SHA512
316be80dcd68fc901092a8f57dd5af9bc6f8931127cebcce3c40c7db694ac09d811bc084f121daa035e83a647affa9f4d4c217b597b7eef3b9fa439c3bfb14c7

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
72KB

MD5
9d2eeab8d022685182a700f59f52336c

SHA1
c573bfb6cea015540b10b385275563624d1cdf17

SHA256
b4f7f6a53aa46dd0c9595f20a2210f0e09964e80dbdb6d2f89e833d85ffc7898

SHA512
a79cb1c4c9f39b31bad80031532b9fda1bb7eeca1607ccb0404c3739b1effc47dc2ff409a0d61f14ba9724c8290d771d8e043c1b1bb82de536923d273f4164ba

Download Submit
memory/1692-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1692-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads