10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644

General

Target

10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
Size

119KB
MD5

77ef3d32ba6d47d9839b0ab1bcc02872
SHA1

dd7672ff75e8d7ab254ad0041491f107a114f25c
SHA256

10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644
SHA512

796a8a2e9438f9552558dcfd88e23fab5c3a634455fcd6df79510e9af53393eddf041b9774f76ddff346c95c4eb91570fddeb3a9ff7748fb44f244008c73f325
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJcbQbf1Oti1JGBQOOiQJhATBHfBo8o3PViYl0:V7Zf/FAxTWoJJZENTBHfiPViB

Score

9^/10

discovery ransomware upx

Malware Config

Signatures

Renames multiple (3448) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2420-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2420-74-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-lib-uihandler.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-utilities.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\misc\libxml_plugin.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\203x8subpicture.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\bin\javafx-font.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\Solitaire.exe.mui.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Google\Chrome\Application\master_preferences.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Net.Resources.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\mip.exe.mui.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui.zh_CN_5.5.0.165303.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\visualization\libglspectrum_plugin.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Windows Photo Viewer\PhotoViewer.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Barbados.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\La_Paz.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\css\RSSFeeds.css.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-loaders.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\calendar.css.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\js\weather.js.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Campo_Grande.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-windows.xml.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_zh_CN.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotiondetect_plugin.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\bin\glib-lite.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Web.Entity.Design.Resources.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\timeZones.js.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\feature.properties.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Almaty.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libpodcast_plugin.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\flyout.css.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_zh_4.4.0.v20140623020002.jar.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\bin\jfxwebkit.dll.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\settings.css.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msaddsr.dll.mui.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_CopyDrop32x32.gif.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
File created	C:\Program Files\Java\jre7\lib\psfontj2d.properties.tmp	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe

C:\Users\Admin\AppData\Local\Temp\10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe
"C:\Users\Admin\AppData\Local\Temp\10743ddc2119def10be7da51e4cacae7f4a16db644fb69bddd9a6acacdb8a644.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3063565911-2056067323-3330884624-1000\desktop.ini.tmp

Filesize
120KB

MD5
29eec244585344fed9c6d261c6f36ce3

SHA1
a5f814c950577f22f9cf24d68a6e8054e503df07

SHA256
e13e3924ffa5ce39a4b9f7173d25397bfed4099c5588911461671d58ed4641f7

SHA512
3d059d413596333fcb23d3d4c302323ce31a9897c730be45e0da882dd2afb638a14dc31ffbebd2f69c3fe6b0c845dab1de3dddd5b13887b88735cd9a6730118b

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
129KB

MD5
f7ffc9b9db10cfc4f8d5aa92869bd6ec

SHA1
224fbc7bae8f9cca1fe7ed01dc3a9bd166b267bc

SHA256
85b8c13426fc430ddae1a06ae0c7e50e12ee54f5b15048790d4237a62e5ed30b

SHA512
78effbb24609f586de87b56510b7cc91f96ee620b65e1fbc824dd3fb36cd8bd69965e515facfd12e2762649a4f42a3fd3bb363f0d92ba80cb5454d548deeb4b4

Download Submit
memory/2420-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2420-74-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads