e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
Size

130KB
MD5

3abc53030b2ed1b6ee20ace17757717c
SHA1

a97fedd913c20b1329de4f6206b7b509fddedcbe
SHA256

e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e
SHA512

27194987148c2544bd6680688e620b019eae08b50c18964dcaae7f6d189fa9d154e4435c8cbdfd690d049c997c80f6e05e70703c20d205668d93fa046862429a
SSDEEP

1536:67Zf/FAlsM1++PJHJXFAIuZAIuekc9zBfA1OjBWgOI3uicwa+shcBEN2iqxtdSCv:+nymCAIuZAIuYSMjoqtMHfhfG

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3442) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral1/files/0x000b000000014b31-2.dat	UPX
behavioral1/files/0x001c000000010439-6.dat	UPX
behavioral1/memory/2220-466-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral1/files/0x000b000000014b31-2.dat	upx
behavioral1/files/0x001c000000010439-6.dat	upx
behavioral1/memory/2220-466-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs-nio2_ja.jar.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\VideoLAN\VLC\lua\intf\dumpmeta.luac.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\feature.properties.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\core_ja.jar.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jre7\lib\deploy.jar.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jre7\lib\ext\localedata.jar.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\Syowa.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\7-Zip\7zFM.exe.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mshwLatin.dll.mui.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Panama.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\PresentationBuildTasks.resources.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\rtscom.dll.mui.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaTypewriterBold.ttf.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsFormsIntegration.resources.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IO.Log.Resources.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvmstat_zh_CN.jar.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\CloseGet.mov.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_splitter\libpanoramix_plugin.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ar.pak.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\VideoLAN\VLC\libvlc.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Simferopol.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jre7\lib\ext\zipfs.jar.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Microsoft Office\Office14\VisioCustom.propdesc.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Auckland.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\Hearts.exe.mui.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libg711_plugin.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\tipresx.dll.mui.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jre7\lib\jvm.hprof.txt.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Microsoft Office\Office14\NAMEEXT.DLL.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.IdentityModel.Selectors.Resources.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IO.Log.Resources.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Microsoft Office\Office14\MAPISHELL.DLL.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Monrovia.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Fakaofo.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File A.txt.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-13.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgzm.exe.mui.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libscte27_plugin.dll.tmp	e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe

C:\Users\Admin\AppData\Local\Temp\e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe
"C:\Users\Admin\AppData\Local\Temp\e6a7e9290b735317afb828d4e135a72d42599e42061f5eb8b0b13f01f61e3d0e.exe"
1⤵
- Drops file in Program Files directory
PID:2220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3627615824-4061627003-3019543961-1000\desktop.ini.tmp

Filesize
130KB

MD5
1f91b49a3a11f0006441f19d38ec5a49

SHA1
fba5fe741ea5d91731fc700210bd541d57208954

SHA256
e589eedcd77b0a890ef4b1ab62da2af262f75abac8cccae95ad1d0ad05a2222a

SHA512
808c1c0f6f18b16dd6445f077dafd448ea8ef2944c547b338e4ad4b8f3cd00a65879d017904e2561e1f5a9243983296675e111b5d52c1dfde06e8db4d5c380e8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
139KB

MD5
3246b58bc6754b3bf587b88972b1be25

SHA1
a370cd5e803d177968ba749455a0b1c3434f67d0

SHA256
b9847b19a47d3788668f52b7c59ee97ac45ed11c5dc8c00270e9a3a05d9c47c7

SHA512
631db19dbcb75dab6ef090fb50c65b8bd3cdf37c09b59f1dd586abfbf3f35e84c1aba9d033eaaf200fb607cf8e552bcc038d9d304e4212dc6009357e2eda612f

Download Submit
memory/2220-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2220-466-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download