691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e

General

Target

691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
Size

124KB
MD5

32b4b4543f9707eeea3a30cfb6a6b6d1
SHA1

d67ebe9c9a0979c9346a9e23ca8e0d9bb212d927
SHA256

691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e
SHA512

1be2d2bf2133f8d6e97e130e4d959e45a9ffeb44d581570e62f07def60858e49c8ca308720b637ef3f9587aa267fe688bbde712534d17964be3a9448c0831901
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCz:+nymCAIuZAIuYSMjoqtMHfhfC

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3430) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3000-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/3000-618-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3000-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/3000-618-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console.nl_ja_4.4.0.v20140623020002.jar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\DVD Maker\PipeTran.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Shanghai.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmagnify_plugin.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-utility-l1-1-0.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\7-Zip\Lang\sk.txt.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_zh_CN.jar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Xml.Linq.Resources.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_ja.jar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\larrow.gif.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-text.xml.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Windows Media Player\es-ES\wmplayer.exe.mui.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-options.xml.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh87.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Tongatapu.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipRes.dll.mui.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsBase.resources.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\02_frenchtv.luac.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Windows Mail\ja-JP\WinMail.exe.mui.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_zh_4.4.0.v20140623020002.jar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\mux\libmux_avi_plugin.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jre7\bin\jfxmedia.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jre7\bin\jsound.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiBold.ttf.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Microsoft Games\Solitaire\ja-JP\Solitaire.exe.mui.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Data.Entity.Design.Resources.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libty_plugin.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuvp_plugin.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libcolorthres_plugin.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.ja_5.5.0.165303.jar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher_1.3.0.v20140911-0143.jar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Qatar.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Mozilla Firefox\mozwer.dll.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ach\LC_MESSAGES\vlc.mo.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\tipresx.dll.mui.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\DVD Maker\audiodepthconverter.ax.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe

C:\Users\Admin\AppData\Local\Temp\691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe
"C:\Users\Admin\AppData\Local\Temp\691a0a5b5dc9446e306b70eee837ac132734a964dccc6fb0ae196528d9b63c9e.exe"
1⤵
- Drops file in Program Files directory
PID:3000

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp
Filesize
124KB

MD5
fff34c3a14b85dd56e0ef7fc3ec6853c

SHA1
02b2d8e8d67517bd8ebda04ccf5f2a736026737b

SHA256
22384ed31e4f96c1fe0341d0035a1878f8473696e4aee2ba048cda33601ea5c4

SHA512
a7031d80587505f6476e113eaf74b3f35282b89496833069a6055cb68ab798a8896b3a0e9fc892e925e38ce430d73fd66d3238989fb4b25cc07dc311d7bf268d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
133KB

MD5
3036f55a9af2e2c1726801b46b83799d

SHA1
ed0e6330279428561ea1af84d9570f663a2ae646

SHA256
c85f6a92a0df2d66119b7b14dc6f8d9dacfb39c165ab9ba38715938f403f2f22

SHA512
8cc97f661bc11f32b1de2344894a7903f45248a1cd2d4e2a23e975cb0538a471ada5864c548ecc46299face3dd80b4cfee6e088e991742495e6d3e1aac9c1b01

Download Submit
memory/3000-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3000-618-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads