93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f

General

Target

93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
Size

53KB
MD5

055f3848ae0b2e952fb07c428a156c2a
SHA1

faaa763defaa004752b85a47679b11ccce392266
SHA256

93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f
SHA512

b368e049f5e344079ad2f67953d6f35641a30325a224714a6203fc793dbb41bbf74b6fa688f6a997209046426335bafaee99b07c74cc3dd290b7c4bf942ed5d6
SSDEEP

1536:CTWn1++PJHJXA/OsIZfzc3/Q8yiAJ1M6hJ1M6X:KQSo/

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3763) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2972-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/2972-86-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2972-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2972-86-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\dt.jar.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\New_Salem.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libanaglyph_plugin.dll.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Search5.api.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-modules-appui_zh_CN.jar.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\settings.css.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\30.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Xml.Linq.Resources.dll.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Services.Client.resources.dll.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Marengo.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Microsoft Games\Hearts\de-DE\Hearts.exe.mui.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\flyout.css.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\22.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\usa.fca.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Macquarie.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.jobs_3.6.0.v20140424-0053.jar.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeulm.dat.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\cpu.css.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\gadget.xml.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\settings.css.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\ij.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_zh_CN.jar.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_dot.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\ShadesOfBlue.jpg.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\mshwLatin.dll.mui.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libwindrive_plugin.dll.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_s.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Zurich.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jre7\lib\charsets.jar.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Java\jre7\lib\meta-index.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\de-DE\ShvlRes.dll.mui.tmp	93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe

C:\Users\Admin\AppData\Local\Temp\93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe
"C:\Users\Admin\AppData\Local\Temp\93d100bf67256ba70a34578affe42679956857dd2f0cd6d7d9aefc7204260d4f.exe"
1⤵
- Drops file in Program Files directory
PID:2972

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp
Filesize
54KB

MD5
3e395efa2e26ca9c7a454d8202f66876

SHA1
edd05954e569b434f6917357fc8a3196748b5abe

SHA256
d2f1dfdf93f960de8d5de5313e6871a7f2cc6ba13fc4847cb73300aae78041a5

SHA512
4051536d8136c84b0806089ec02d73c23716eebd085580c129ed6c012b8d4fa06f8ae582b5c9c85204f2ed15b3171822435d0cb308ef5cb76f492aed72c32f32

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
62KB

MD5
9b6e68fa14cad570551dc5b48ed01d96

SHA1
878b477edb0413bacc25fd05c1b4cf3b818110a9

SHA256
7654ccfe5db3d0e49064df26c19d2e67fd96ca6b3800a4ae49685a479f78ac28

SHA512
8d5f199b576d9f518b7f905de1114f4d4f7bee121c53f2f41917f0f8891616b364d59530744ce6aebd004db023f0d673f2052c6e2c8fcec2df1d3f9ebc2949cc

Download Submit
memory/2972-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2972-86-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads