10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644

General

Target

10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
Size

119KB
MD5

77ef3d32ba6d47d9839b0ab1bcc02872
SHA1

dd7672ff75e8d7ab254ad0041491f107a114f25c
SHA256

10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644
SHA512

796a8a2e9438f9552558dcfd88e23fab5c3a634455fcd6df79510e9af53393eddf041b9774f76ddff346c95c4eb91570fddeb3a9ff7748fb44f244008c73f325
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PViYl0:V7Zf/FAxTWoJJZENTBHfiPViB

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (2854) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3040-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/3040-68-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe

description	ioc	process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_de.properties.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Rainy_River.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-image-inset.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\npdeployJava1.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\zi\WET.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ShapeCollector.exe.mui.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dushanbe.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Choibalsan.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Beulah.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\TipTsf.dll.mui.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_ja_4.4.0.v20140623020002.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.nl_zh_4.4.0.v20140623020002.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Pohnpei.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\bin\awt.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-convert-l1-1-0.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\mip.exe.mui.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_zh_4.4.0.v20140623020002.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\oledb32r.dll.mui.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia_Banderas.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5EDT.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\about.html.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\notification_plugin.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.di.extensions_0.12.0.v20140417-2033.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861261279.profile.gz.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-io_ja.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jp2native.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-charts.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Mozilla Firefox\qipcap64.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_ButtonGraphic.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Mozilla Firefox\msvcp140.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaremr.dll.mui.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\DVD Maker\directshowtap.ax.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\high-contrast.css.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe

C:\Users\Admin\AppData\Local\Temp\10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
"C:\Users\Admin\AppData\Local\Temp\10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
120KB

MD5
5737baa4c5ab34073df28e53176f5770

SHA1
e390fec4aabcb35575ba1c17aa889d15f0f44e25

SHA256
ee59df84f73cfc88eaa375f32b664a7458db9d16e73a53766989614fbf4599d4

SHA512
5dc8b45ee7767c90fa796fd5a08d42f5112aedd8153bedb75c72415d585463e9f794edbdb00451d4635606476c88a890485961447bef40be49995510d433a9ee

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
129KB

MD5
8dce79805dd5ee1fc0b2014d31698ccc

SHA1
ddea0a5a498237c89357a33267db58fca3838151

SHA256
0661f821e45517ca79ce96813899b35eb98d673d9cb4059cde73eae86b790966

SHA512
c41907c0f6864411f87ac19779b61a13575b590f4aca5329d916fa20aef1f12efe27b1261f9600e2028b4900191aa0ee1e5a7051abc35a0ac62eefdc7334c825

Download Submit
memory/3040-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3040-68-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads