e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1

Analysis

max time kernel
148s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/04/2024, 04:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
Size

96KB
MD5

123fd0ba7a5a7f2ee5add0ac5dda7cd0
SHA1

2bcd0a774113a3f896d89929f5a6005628c19749
SHA256

e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1
SHA512

e007de7a1ddd9f15d153334714a27a4c954e43f3906b535e0b9d037e551af9c66b08450a3e079504e71dd6b4af0accc01df13237b6762cea941c2736b6ea359f
SSDEEP

1536:Isz1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCow8hfq:hfAIuZAIuYSMjoqtMHfhfq

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (515) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1500-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral1/files/0x000c000000012240-2.dat	UPX
behavioral1/files/0x0002000000010481-6.dat	UPX
behavioral1/memory/1500-20-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1500-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x000c000000012240-2.dat	upx
behavioral1/files/0x0002000000010481-6.dat	upx
behavioral1/memory/1500-20-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IpsMigrationPlugin.dll.mui.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Mask1.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Internet Explorer\Timeline.cpu.xml.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Internet Explorer\ieproxy.dll.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\glib-lite.dll.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\7-Zip\Lang\hr.txt.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\System\ado\msader15.dll.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msadcor.dll.mui.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\rtstreamsource.ax.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_glass_Thumbnail.bmp.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hu.pak.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\sv.pak.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXEV.DLL.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground_PAL.wmv.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Internet Explorer\networkinspection.dll.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java.exe.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\TabIpsps.dll.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\MSTTSLoc.dll.mui.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Internet Explorer\en-US\eula.rtf.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\msinfo32.exe.mui.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\libEGL.dll.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\en-US.pak.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NavigationButtonSubpicture.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ru.pak.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Internet Explorer\MemoryAnalyzer.dll.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\fr-FR\OmdProject.dll.mui.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\System\msadc\fr-FR\msadcor.dll.mui.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogoBeta.png.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\micaut.dll.mui.tmp	e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe

C:\Users\Admin\AppData\Local\Temp\e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe
"C:\Users\Admin\AppData\Local\Temp\e8621a83746aae614626b36ff434d77ef9350f2455677bb1818075eb30f971e1.exe"
1⤵
- Drops file in Program Files directory
PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-330940541-141609230-1670313778-1000\desktop.ini.tmp

Filesize
96KB

MD5
0626b0c4cba06b46582c5d886613ca8c

SHA1
98820909ab2cbc9df2d579c560ae550057538bc3

SHA256
41782313d4c9b8f7254d00627b7b1024644d674e2dab36b8140aedf8fd16ead1

SHA512
2cc396722e8c59295eb0d492ae5e585cc7284a3727cc88698b62191cfa5eea855546178bfbe3e3d37ecac868c6d7c961292873ea40956d1e4a9b3d40a864b60d

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
105KB

MD5
b3bc06880937d844582d1588c1390b3f

SHA1
6b5c801be2d3575c8fe3f23cfc724f00054631d9

SHA256
cdb7ab30478424b9c10d7dec437d8ed02bb8995fb034b7bfc8e97b81a295d8b6

SHA512
509d945efdb97f003b4df3a171c037a7af8a704d575b5f7c45adbf07c222598a38de492656231cb1750b0a8e23e22ee6f8a5aa44e5afb1dbcdecb9c91a419070

Download Submit
memory/1500-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1500-20-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download