6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735

General

Target

6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
Size

195KB
MD5

3c39e034ff26d403cdfccacea38acbf5
SHA1

f45d2de958018c07688871efcc14ac37d25ebd46
SHA256

6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735
SHA512

56dcd478f0e85ea78e3e5c0d04738866e1211c228692192c6abafea3f079ea8da6059b097c8f6f3608ebe0a990a917f5e381d0c9b1c422722a29b5b598a86ef3
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCo:+nymCAIuZAIuYSMjoqtMHfhf4Y

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3231) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/2968-598-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2968-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2968-598-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe

description	ioc	process
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Linq.Resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator.manipulator_2.0.0.v20131217-1203.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Paris.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfralm.dat.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.access.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Entity.Design.Resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe.sig.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre7\bin\jabswitch.exe.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\Chess.exe.mui.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_ja.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\System\wab32res.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\external_extensions.json.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_ja.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Los_Angeles.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\classlist.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre7\lib\logging.properties.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kuala_Lumpur.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwresmlm.dat.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_CN.properties.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IdentityModel.Resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ant-javafx.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser.ja_5.5.0.165303.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\rtscom.dll.mui.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libudp_plugin.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_ButtonGraphic.png.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Games\FreeCell\ja-JP\FreeCell.exe.mui.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property_1.4.200.v20140214-0004.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre7\lib\security\US_export_policy.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Speech.resources.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_zh_4.4.0.v20140623020002.jar.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Games\Purble Place\it-IT\PurblePlace.exe.mui.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\VideoLAN\VLC\libvlc.dll.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui.tmp	6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe

C:\Users\Admin\AppData\Local\Temp\6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe
"C:\Users\Admin\AppData\Local\Temp\6b4065b347368d3d12ad4ad65437089337a8b2212dcbb669c355b9b8764bf735.exe"
1⤵
- Drops file in Program Files directory
PID:2968

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp
Filesize
195KB

MD5
ebcf1c9c4978f99d98d3b1e725f9d0c6

SHA1
c8288309f870e971fd9da257d6b0df7575c25a9b

SHA256
30b3cfa61809c3ab932c64c40f449c80915e2af9b611227bc15cb29cd8339a69

SHA512
9a9f528d74c6ae6401cc4a5ad5bd4a7ac3d949cb695115d5bcb00f3d3bf0065992500e05543bf403160ffafe1520f0082f1e37e259cdb892950bc397a3050e44

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
204KB

MD5
6e80fb801de71bff283c896676906100

SHA1
8d6464370a7f5a9c28d61549b3e8f2b6e7570a9b

SHA256
16b76e1c350ca6359aef3f85152d7fe56dface04cb6d6dcf5979ee8b421cee3e

SHA512
661e41636a54bd4adbc0687e33fab0090dc329d0ea560c0ef63b3778777179aed8ab1dc5f0b64f01c9554a5b2dfa22ed2873447416e0647e0202d7abe3d446d9

Download Submit
memory/2968-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2968-598-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads