c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377

General

Target

c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
Size

103KB
MD5

1bedc075301dcde41a16b5e76421638f
SHA1

fdc0d9f81122fc92cec5b6ade620cf2b42b54138
SHA256

c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377
SHA512

3fe6ec7aac289c814076df93997915ce5e42d2d8508785c8e4d8dede6bacafe651a862877310665e420c005431940fc4bfc6ce023da83f81d2bc3a673d2172d0
SSDEEP

1536:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8yTWn1++PJHJXA/OsIZfzc3/Q8h:+nyiQSopQSoK

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3520) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/2036-654-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2036-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2036-654-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe

description	ioc	process
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_udp_plugin.dll.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\javafx.policy.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\feature.xml.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Mozilla Firefox\lgpllibs.dll.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_right.png.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_cloudy.png.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark.css.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jre7\bin\javaw.exe.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Microsoft Games\Hearts\ja-JP\Hearts.exe.mui.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatsh.dat.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3.nl_ja_4.4.0.v20140623020002.jar.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jre7\bin\java.exe.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\PresentationBuildTasks.resources.dll.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rainy_River.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Windows Photo Viewer\it-IT\PhotoViewer.dll.mui.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\42.png.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans.nl_zh_4.4.0.v20140623020002.jar.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.util_1.0.500.v20130404-1337.jar.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Thunder_Bay.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\7-Zip\7-zip32.dll.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+11.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Honolulu.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util.jar.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Microsoft Games\Mahjong\de-DE\Mahjong.exe.mui.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\images\Video-48.png.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-core.xml.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\dailymotion.luac.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsubtitle_plugin.dll.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\settings.html.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\profile.jfc.tmp	c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe

C:\Users\Admin\AppData\Local\Temp\c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe
"C:\Users\Admin\AppData\Local\Temp\c5b515d0832e2e51005003f16eafbc41cbf1f7f664d38a65ef16a372f975b377.exe"
1⤵
- Drops file in Program Files directory
PID:2036

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.tmp
Filesize
104KB

MD5
a1af9d0b7aa89176b10e7efdb4e40a0b

SHA1
b3c18f780889be70c0623ceb00cb47c6eddcd563

SHA256
77308be2ae8924bd9b6fdaa3fa5a04ac10b57c72cb1a74232b0c68b1468cb090

SHA512
f649b829915f49186d68aa7dc99eb1ef76e93b70bb6ab4284dedc9105e1ce2931df798b41a52330a68b44a816f03116f665deb15c49c046c49ec992409432356

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
113KB

MD5
34af178e4681315a4a5e95e2a71aba65

SHA1
8e028def6d8c4836a0d0d50c78a622d2ac04d2b9

SHA256
07931b1d6c2516254303ca999943bb3f04c3d49216dab9f6b73450bb3ae1b126

SHA512
13c57ece8c2e91fede60b8014743ad1b2de2252e8bb988e091a3471b88d6a98f96719b716a43551e5ee28d244f3ba2a2b0604b04c7f099275c7c78c76ca9f0fd

Download Submit
memory/2036-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2036-654-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads