41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202

General

Target

41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
Size

170KB
MD5

7501869e973c7c25db1a4ede40c52bc2
SHA1

4c5dd39589da0b6b81e8904fc8062d1423cfad07
SHA256

41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202
SHA512

f14dceba9b34dcbcf7080c72dd8d58c7fcb40de6e3611cfb14f354bda82edab59fe8f29f971344b2e374a13a02098bbc10ba9bba42d818fc728875d095a19db0
SSDEEP

3072:+nyiQSo17UYsC+hALfUqI0qEiDW6VcQgKX58r7:JiQSo17UYsC+iLfUY8DtVcaX56

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3345) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2328-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/2328-614-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2328-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2328-614-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\tipresx.dll.mui.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\TipRes.dll.mui.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\DVD Maker\rtstreamsink.ax.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Qyzylorda.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libheadphone_channel_mixer_plugin.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\London.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\zi\Atlantic\Cape_Verde.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\jsse.jar.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\en-US\shvlzm.exe.mui.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\7-Zip\Lang\ku-ckb.txt.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_matte.wmv.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Puerto_Rico.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Kiritimati.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-backglow.png.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\kcms.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Port-au-Prince.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\bin\javacpl.exe.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Microsoft Games\More Games\it-IT\MoreGames.dll.mui.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\bin\jpeg.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Athens.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Mozilla Firefox\removed-files.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libremap_plugin.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.nl_zh_4.4.0.v20140623020002.jar.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.historicaldata.zh_CN_5.5.0.165303.jar.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\CsiSoap.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\meta_engine\libfolder_plugin.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\javaws.jar.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Tunis.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwritash.dat.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee90.tlb.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Casablanca.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Nairobi.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Monaco.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\vlc.mo.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll.tmp	41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe

C:\Users\Admin\AppData\Local\Temp\41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe
"C:\Users\Admin\AppData\Local\Temp\41af4ff93350afa8fc13adb1f5dd091a018bdd24ed6ec155bb143475a42a7202.exe"
1⤵
- Drops file in Program Files directory
PID:2328

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1298544033-3225604241-2703760938-1000\desktop.ini.tmp
Filesize
170KB

MD5
6b7588493093d84abea47e1eea30b47b

SHA1
97fdaf99e774694f540b471122fe3223e77dba37

SHA256
6a55ddd4e06a42f801fe2380f05d8718f4b2f5965c0760aa2432d98e944f319a

SHA512
12086c1f3f3388b6b50d23dcb6d16133aa8a4f699c3b7cbc339313fa3f10f02c9053f57310fc8def37b23a345a036888b4ae7ef0095877e2fffc64683b4066f3

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
179KB

MD5
4da6dcdbd3534b9f268a2efe857a9c70

SHA1
389e1f15ce232939bb7f87d8a0c53bedcf029676

SHA256
a3655e5ecb9e650c4d6474bee4bb98c1ed726317aa57b7a56919c48d4e4d66ae

SHA512
2f55924d956e5e914d23dc5f1e59f5f106116cba6911f4482d7a034ff8c402d9c05309fdd377c3c7485f41bd819fb56fe99456acd98409f7d1c05429be5c6bd6

Download Submit
memory/2328-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2328-614-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads