6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452

General

Target

6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
Size

47KB
MD5

42f23960db54bd87dbc8c6c0f0f0b9ea
SHA1

cec752f1ac3371f5e8a3b9608f0e22a766131efa
SHA256

6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452
SHA512

cdc1ecce363c6bd0224e7a0fd7c1bc36c8080c5097f66e73c7a5b6f023677285603994396c02607f3b01d4fc1b793099b72cbce08dab3e172e7b4408342fc72d
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzV:CTWn1++PJHJXA/OsIZfzc3/Q8zxD

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3728) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/2200-86-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2200-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe

description	ioc	process
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\currency.html.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Miquelon.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-windows.jar.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_zh_CN.properties.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Windows Defender\fr-FR\MpAsDesc.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\cpu.js.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IpsPlugin.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup-impl.jar.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-uihandler.jar.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jre7\bin\server\classes.jsa.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Design.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\tipresx.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxmedia.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libextract_plugin.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Mozilla Firefox\install.log.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Waitcursor.gif.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mshwLatin.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\DVD Maker\sonicsptransform.ax.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-actions_ja.jar.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jre7\lib\deploy\splash.gif.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libflaschen_plugin.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+3.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\currency.data.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\gadget.xml.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7MDT.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\Chkr.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.Design.resources.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot_lrg.png.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_precomp_matte.wmv.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Microsoft Games\Hearts\fr-FR\Hearts.exe.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ShvlRes.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Windows NT\TableTextService\de-DE\TableTextService.dll.mui.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\7-Zip\Lang\yo.txt.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Small_News.jpg.tmp	6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe

C:\Users\Admin\AppData\Local\Temp\6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe
"C:\Users\Admin\AppData\Local\Temp\6ccdbc35706b31557bc6fc5b129c45400bb6e52dc8b2bc36059687fe47857452.exe"
1⤵
- Drops file in Program Files directory
PID:2200

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2721934792-624042501-2768869379-1000\desktop.ini.tmp
Filesize
47KB

MD5
988b5a3b2a470c35b6a52ea069e2910d

SHA1
8d3edda01b4b081990d2c2dc66e01a7aa8c9eb70

SHA256
aadfcdc10170a375d837649feeaeb260cae66ed6b3533805e5eee6522512de3d

SHA512
e9541076123333c96dfe1ac531c32c9118397336c1471ffcdc44eb2bcaf5932b301b267aa113797d4f7e93345c7fe3069b1d0d4dacd5d9c9607008c39f8dd7f5

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
56KB

MD5
b9f00366dfcf17b33e69233422d89a20

SHA1
bc9b6ba901e086dfc5e2a0cd1d6ba8e0aaa97db2

SHA256
243e75f2746c97a8ff2c20e7dff3415db0456f2e863eda44dec2f47bb4f2312c

SHA512
372ca490172d054b126fc94c87e9919d7472324142d4d2bc76528ef53ef745d21f1ebad3d30568d13fd836726c511bc3d130661c04552d80af1faf6ee2de6a7b

Download Submit
memory/2200-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2200-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads