e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077

Analysis

max time kernel
149s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
Size

52KB
MD5

7b2a015924d0c41732211c970b575344
SHA1

0d1fd47a80a14ccef3eb264e09e6754be3072387
SHA256

e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077
SHA512

8a8a7198d4b116cfb0694cfc954579cd64d28ff6a8b9ca3a6c8a114ee68dd4dc5da780d492ad9e054a61d598edcd94b73ff56e540832eaf617cec4efb38acc81
SSDEEP

768:kBT37CPKKIm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sg2aDM9uA9DM9uAFzD:CTWn1++PJHJXA/OsIZfzc3/Q8zxx

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5190) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3568-0-0x0000000000400000-0x000000000040A000-memory.dmp	UPX
behavioral2/files/0x000700000002328e-2.dat	UPX
behavioral2/files/0x0008000000022970-6.dat	UPX
behavioral2/memory/3568-1104-0x0000000000400000-0x000000000040A000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3568-0-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral2/files/0x000700000002328e-2.dat	upx
behavioral2/files/0x0008000000022970-6.dat	upx
behavioral2/memory/3568-1104-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\System.Windows.Forms.resources.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Java\jre-1.8\Welcome.html.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ul-oob.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ul.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.SqlServer.Configuration.SString.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.GRAPH.16.1033.hxn.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-oob.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\MSOSEC.DLL.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-ul-oob.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\PROTOCOLHANDLERINTL.DLL.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\PresentationUI.resources.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pl\System.Windows.Controls.Ribbon.resources.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\it\System.Windows.Forms.resources.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-ppd.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IVY.DLL.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Debug.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\deployJava1.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\plugin.jar.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Banded Edge.eftx.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessEntry2019R_PrepidBypass-ppd.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXT.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Core.NetFX35.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp6-ul-phn.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Common Files\System\ado\msado15.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.Reader.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Intrinsics.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_Subscription-ppd.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-pl.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.MemoryMappedFiles.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\Informix.xsl.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationClientSideProviders.resources.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\Microsoft.WindowsDesktop.App.deps.json.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Internet Explorer\IEShims.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_F_COL.HXK.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\System.Xaml.resources.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Trial-ul-oob.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\FRSCRIPT.TTF.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRLEX.DLL.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Common Files\System\msadc\msdarem.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscordaccore.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.Primitives.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\mscordbi.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\UIAutomationTypes.resources.dll.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Java\jdk-1.8\include\jni.h.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN114.XML.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.tree.dat.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PowerPointCombinedFloatieModel.bin.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.tmp	e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe

C:\Users\Admin\AppData\Local\Temp\e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe
"C:\Users\Admin\AppData\Local\Temp\e34d46115b71a46c8b4aacc04e149f7853051bd978e8108317ef133d63992077.exe"
1⤵
- Drops file in Program Files directory
PID:3568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.tmp

Filesize
52KB

MD5
93696937545cd09b3d980df74114847e

SHA1
cfa9ea2f3c222b83f2c1509101f6a38e408e5a14

SHA256
28897dba52ae74ec6d77f3b43c3f8e28ee956547e6ff983e75cb25a783f9886d

SHA512
5eaf8354f26a5238b8527d7882e641b962dff8a42b78105e4b051b65bf5e0bb5313c539e1e2da938b8e6c00779d1538aecd70acd6433022642203424ebf7b670

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
151KB

MD5
ee7195af54e1ef6804a3d149fdcfdfb3

SHA1
04b45f2904a16607631b56d79bc1f190ebed1f24

SHA256
464e75c3ce1660d438a4506d135b942b9a50e01fa63960f14047dbf741bd7077

SHA512
69f912f14e445b5aea7de1f941dffd716d4416eed0302c38901c9e949c2e050134dcfed1d0b1abeab131d2e4a0ecd0e5e3cc6a48cef80cc846645e3af0d62037

Download Submit
memory/3568-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3568-1104-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download