b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99

General

Target

b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
Size

99KB
MD5

8b3a85c82a3aa8d9d2ef9c4db37fc24b
SHA1

60cb67e914742e8c9f765f3004aeb07b97a91900
SHA256

b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99
SHA512

ebff066c5ea6c5da4f586d824c7d491dd809ad2b5642c9adf942d3ee920515fa38590f8cc482c58c7de32799b9df7d0bffb558ccf5864ca6de99da37f02eaf04
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfA:hfAIuZAIuYSMjoqtMHfhfA

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3452) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2056-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/2056-76-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2056-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2056-76-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\fur.txt.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgRes.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libopus_plugin.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4video_plugin.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre7\bin\kinit.exe.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Mozilla Firefox\defaults\pref\autoconfig.js.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\OutStop.mpeg.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_output\libgl_plugin.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\SearchGet.m4a.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mk\LC_MESSAGES\vlc.mo.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Cambridge_Bay.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\css\calendar.css.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-4.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-core.xml.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\css\cpu.css.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\System\ado\en-US\msader15.dll.mui.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7Handle.png.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-uihandler.xml_hidden.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\ShapeCollector.exe.mui.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\New_Salem.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libaudioscrobbler_plugin.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler.xml.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-api_ja.jar.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sr.pak.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.nl_ja_4.4.0.v20140623020002.jar.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Taipei.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\ImagingDevices.exe.mui.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Troll.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Macquarie.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Lisbon.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2.tmp	b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe

C:\Users\Admin\AppData\Local\Temp\b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe
"C:\Users\Admin\AppData\Local\Temp\b38e361559fb2d3e8de81f942c6e78a4abc15cef02749973a8ae4faf8c535a99.exe"
1⤵
- Drops file in Program Files directory
PID:2056

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini.tmp
Filesize
100KB

MD5
02945736e90892ee041454ffa361e1c5

SHA1
7cbd09f47722f2476f92cd820933d098a716d20f

SHA256
774e27d7cd2fdcaee27a8c988db14cabd3833eb605d2587628d0e55b77a16e3a

SHA512
aa583d0f75d9c3ccbd8d1a8fb61a729f7bdf12dedf7c5f1e44eba50d1831fcbf02fd6a3950678bae1978f085dedf87849cd4abb3b654c0a502165797ec822c13

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
109KB

MD5
8ab64d51aa8c36700504dc8b7f74159d

SHA1
f1fc71977480c98767df717b4f79112232bfb033

SHA256
242dc09be6490395dd2104b2af3d197dfe03114f9d6c908b2800005f6c31cbfd

SHA512
bd785aecd63a39afbb11dc809b7c0b55a6919dbd3aa1507c69c5b52bcc45df09cbee049ec8a7af6cb901b3ccac4e32704b768799fa9ab608aab76b91769adb36

Download Submit
memory/2056-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2056-76-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads