7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5

General

Target

7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
Size

74KB
MD5

36b3c238e42a23880057dce3935bc9d9
SHA1

ae4f2a135510dffd89f0b5e87625eaff7dddbc82
SHA256

7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5
SHA512

c53905bdd3fc7a7e94952e2b94585651a8dc8c7d1c974f3b33a35a0ddc6eb440163507bb489fec04d935364323c8bdb6b2cf904760d56a9852716e763242edf8
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8xJJMJJ2:fnyiQSo0

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3708) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2976-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/2976-666-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2976-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2976-666-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Common Files\System\Ole DB\es-ES\oledb32r.dll.mui.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfr.dll.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\view.html.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\kn.pak.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Windows Media Player\wmpconfig.exe.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\logo.png.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libafile_plugin.dll.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Windows Journal\Templates\Seyes.jtp.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground.wmv.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Internet Explorer\DiagnosticsHub_is.dll.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Damascus.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libdvdread_plugin.dll.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\ConnectUnprotect.sys.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Windows Portable Devices\sqmapi.dll.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lt.pak.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\fr-FR\shvlzm.exe.mui.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\settings.html.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern.png.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipBand.dll.mui.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jre7\bin\npt.dll.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libvoc_plugin.dll.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Windows Mail\fr-FR\WinMail.exe.mui.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\settings.js.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TipBand.dll.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kwajalein.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\orb.idl.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup.xml.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationClient.resources.dll.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipBand.dll.mui.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG_PAL.wmv.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files\Windows Defender\MpOAV.dll.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\DigSig.api.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif.tmp	7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe

C:\Users\Admin\AppData\Local\Temp\7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe
"C:\Users\Admin\AppData\Local\Temp\7dfb560940ecdebeba13034105109deffff8d09fd601d71812ec3ac4d01987b5.exe"
1⤵
- Drops file in Program Files directory
PID:2976

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp
Filesize
74KB

MD5
295c93a27d2cc11b794a7558a6ea56e7

SHA1
ce30c24a72fcbf1381e9d4fea94e2840fd6b255a

SHA256
c4781621e7347ab4c61fcdb3c9e66051cac83d05847947401eb3e35e71192173

SHA512
1ab09ba974891908d8f1599cdd5ab8342b5106b0a9864ee68b2d7f16997397f4c59424a60b812238f0ea3920c0719ec86dffc33413a2ba84460bcc30d0ec3be5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
83KB

MD5
ee34a9a32c8787c27c0c0383dc843b94

SHA1
bb109aa3772b30b2cb8d5b90403ffdb0fc457989

SHA256
d26c1a1a4c92cea79c5623febe5a3a7eeea7bc03fc38a90fee77719aac1f1e9f

SHA512
7660d49a59ad331d386d8893908e2f66841dfada0d32ebd0f8d7e52d84552cb703b65215a74cc0d8a175c84002a96670bc36a646dbabb1485b7aca620ab5060f

Download Submit
memory/2976-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2976-666-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads