e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
Size

83KB
MD5

36a92ac02806fa2776dd12483a6cb49e
SHA1

e00b43b0cb8463893b067c6f80c5a24504fc090b
SHA256

e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a
SHA512

6141db3cfa9a1a54256d98ae27a513a85df04069d014a82e3e80957698167264d7a156fabd56d4dd6184467a6ed50cd11c4849e169e1ec04767b9e163b0e9c6d
SSDEEP

1536:a7ZyqaFAxTWH1++PJHJXA/OsIZfzc3/Q8VCnXxX81M4q:enaypQSoPXxXz

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (3142) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2108-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-2812790648-3157963462-487717889-1000\desktop.ini.tmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/2108-283-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2108-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-2812790648-3157963462-487717889-1000\desktop.ini.tmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/2108-283-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.ui_5.5.0.165303.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.ini.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\bin\installer.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\mshwjpnr.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledb32r.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtau.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiling.xml.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.jrockit.mc.rcp.product_root_5.5.0.165303.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\bin\gstreamer-lite.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Mozilla Firefox\omni.ja.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libcvdsub_plugin.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Colombo.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\about.html.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Panama.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\libxslt.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-dialogs.xml.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-fallback_zh_CN.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-execution.xml.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Belgrade.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\icecast.luac.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720x480icongraphic.png.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Kabul.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Ust-Nera.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\triggerActions.exsd.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicHandle.png.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_SelectionSubpicture.png.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\liba52_plugin.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_zh_CN.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.actionProvider.exsd.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Common Files\System\msadc\msadcs.dll.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Beirut.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_zh_4.4.0.v20140623020002.jar.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-outline.xml.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
File created	C:\Program Files\Java\jre7\bin\java-rmi.exe.tmp	e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe

C:\Users\Admin\AppData\Local\Temp\e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe
"C:\Users\Admin\AppData\Local\Temp\e0d49b8213c87fc566369a03f94fe17388b3f62ba788751d4acbf9265f64d88a.exe"
1⤵
- Drops file in Program Files directory
PID:2108

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2812790648-3157963462-487717889-1000\desktop.ini.tmp
Filesize
83KB

MD5
fafeae99884d77ff9f3cb1b363f1368d

SHA1
378557c6301ede3beee5046ad518404bce152f73

SHA256
fb3ced20afc3afb1cb789159d79ee3b7af579687f6fb995e8067215b0b43389c

SHA512
b3881a3768261210024e0824eeef3abb832f6b0734e4f745025162a2159b71ee374deb98e60242c9ea860cdbaa8d7b98dcccd04bdab891190e6d460762f7fde9

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
92KB

MD5
afb7ca8a37296f6b5ff67a23fd403b38

SHA1
c6c76341f5d8394c45e857fa5bc5542e37e25618

SHA256
e200aa03b752fca5d440e3c3f381e5372f91df1947ac1b13e7995798b2d0ec99

SHA512
5216734984c548c397cf0803f474cb541b9f3e881b844e56f5ce4eb92e384aab03eae87e91963a61ebd163cc08909702e890294c052187dadbbf10a474969103

Download Submit
memory/2108-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2108-283-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads