2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae

General

Target

2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
Size

58KB
MD5

26d103c339291f1fa7f07d4209b53ab5
SHA1

bbf7a6ce9d1e43ab5aab983c082d78c4c38eb5d5
SHA256

2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae
SHA512

47e85188b24308aeb3d7823ba8966ef884f5e8d3f91cdcc716a12cff62804c5f910bdbefa3f3df0c7e325f0cf114b2827a7bb664148dcd920a1dd5a9ee2e9670
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFFv:CTWn1++PJHJXA/OsIZfzc3/Q8yiz

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3732) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1280-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/1280-76-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1280-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/1280-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_zh_CN.jar.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\ReachFramework.resources.dll.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\oledb32r.dll.mui.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitevignette1047.png.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Adak.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\ShvlRes.dll.mui.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Client.resources.dll.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libhttp_plugin.dll.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_sse2_plugin.dll.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\clock.css.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fi.pak.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.swt.nl_ja_4.4.0.v20140623020002.jar.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkHandle.png.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.FNT.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Internet Explorer\images\bing.ico.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Moncton.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Mexico_City.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Journal\ja-JP\NBMapTIP.dll.mui.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\RSSFeeds.js.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\weather.css.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\PhotoViewer.dll.mui.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-settings.xml.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\localizedSettings.css.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\Center.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Mozilla Firefox\update-settings.ini.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msaddsr.dll.mui.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper.registry_1.0.300.v20130327-1442.jar.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jre7\bin\splashscreen.dll.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jre7\lib\deploy\splash.gif.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jre7\bin\orbd.exe.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or\LC_MESSAGES\vlc.mo.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\fontmanager.dll.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jdk1.7.0_80\release.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Simferopol.tmp	2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe

C:\Users\Admin\AppData\Local\Temp\2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe
"C:\Users\Admin\AppData\Local\Temp\2ca0a62cfb6d094ff261565d71ca0888cb00d694056805dcbdd2b8d1ac0bdcae.exe"
1⤵
- Drops file in Program Files directory
PID:1280

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini.tmp
Filesize
58KB

MD5
64e0290fabd41727c16357060a5c9f88

SHA1
45cf7701f578ba8d4d2541b6c7a908d6da4fac06

SHA256
e363a91e7f55420e46e3981a654891d1a8ef6f9d38bc85c70fde4f699a7c9851

SHA512
707fcc2aab5927753a6d755906cc55d9c266c6b1f1b406164339827e7e2a65dac0c497768493b84d6b73cc7aea86bcd7afcc843b4900cc872014634d7a1291ac

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
67KB

MD5
73d9d61720a8cc52744654b5546c2c4d

SHA1
432b1560bd34517e1ba197e8e8e83332575ea763

SHA256
fe94449de0f70e8cba9ea097427367e727ead32cfbd72a9214631c41b154cb1a

SHA512
2d7f705a991e1e44438b21f2c0f55c9870135b9deec1ae5ff660707acb87e8ea91064aeab7628e2953a94cd76c7227375792e219c1cf044cb9353ddbc5bb0d02

Download Submit
memory/1280-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1280-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads