28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1

General

Target

28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
Size

57KB
MD5

73cb66c0a8327950f74f74c97f5ee355
SHA1

78430083b1e28dc8075a011dc907bb24cef43e41
SHA256

28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1
SHA512

7a0d11ae52435440c5ee7bd344e528d7cb8a23a87c120b9187b8a14209595fde54017d6b9f39eddeb4fbc72c4b00b847fa0ee452e8df385878801fb4b86d6199
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8yiAyI8yIs:KQSoLSs

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3765) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/1704-86-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/1704-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe

description	ioc	process
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\js\settings.js.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InkWatson.exe.mui.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Davis.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\localizedStrings.js.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\La_Rioja.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\liblua_plugin.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Windows Media Player\WMPNSSUI.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Rome.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Management.Instrumentation.Resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Design.resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\vlc.mo.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\LightBlueRectangle.PNG.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\settings.js.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\http.luac.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libt140_plugin.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sendopts.xml.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\css\settings.css.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.ja_5.5.0.165303.jar.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Windows NT\Accessories\it-IT\wordpad.exe.mui.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-output2.xml_hidden.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightItalic.ttf.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mshwLatin.dll.mui.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST7MDT.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\VideoLAN\VLC\NEWS.txt.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\FreeCell.exe.mui.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\DVD Maker\Shared\DissolveAnother.png.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.reconciler.dropins_1.1.200.v20131119-0908.jar.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.Services.Design.resources.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\vlc.mo.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_ja.jar.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-api-caching_zh_CN.jar.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\j2pcsc.dll.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\plugin.xml.tmp	28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe

C:\Users\Admin\AppData\Local\Temp\28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe
"C:\Users\Admin\AppData\Local\Temp\28b4e88ee7bbaedc65246723af1e64da3081cb71080afd4351c463ac722bbec1.exe"
1⤵
- Drops file in Program Files directory
PID:1704

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2737914667-933161113-3798636211-1000\desktop.ini.tmp
Filesize
57KB

MD5
3eba06bf018f857efb491e7b25e6bb82

SHA1
7afb46248633cd615d68cf8e36edd0ba5c86bf13

SHA256
b8ceafbe5523011d0d06f2ca08c8a27ee03890ebae24e92cb2f9af4ddac58eed

SHA512
f3a5c79c87eb72145241086248eee8d8e6af6dad90f06d2c8c701a559236124daad1e8d3e39c6f1185beea00dc705a2d02c0a0f87725b309bc72b32a0b577ccd

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
66KB

MD5
954d10e54e04a20a2fde246fec66192d

SHA1
922ae28596ecf707be14f92b4b4f582781b99e99

SHA256
f93d1e955803ac0f3ca376332b3e8bc2083453ea867edd1d7db99f485b1d6492

SHA512
83d762b4db5d3ba8103d5d9e0e0a1f60778e727d6fb60dcbf3b0ee00bd2d4c1afaf7e0168eaff85fe869a13ca9028f72686f5fbf5076128abf12dc4541e56f54

Download Submit
memory/1704-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1704-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads