e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
Size

105KB
MD5

d9a7a7092710a7fc05bf16ab6ba66cd5
SHA1

a483826af7b897fa0141f38056e23731e39e62d1
SHA256

e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e
SHA512

e7ceac37c616cef4d05c1a6e3ddf990a4aab892ebf89aae35d2db29a20a07c86409273fc2fffdee616afdac598096ba243f20078216e0f053be0c281ff766744
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxtjm8szV6VSWtV6Vp:fnyiQSoojmHzV6VSWtV6Vp

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (2846) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp	UPX
behavioral1/memory/1320-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	UPX
behavioral1/memory/1320-162-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp	upx
behavioral1/memory/1320-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp	upx
behavioral1/memory/1320-162-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe

description	ioc	process
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guyana.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_win.css.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Adak.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\bin\jaas_nt.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Chatham.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_ButtonGraphic.png.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\El_Aaiun.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-14.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.xml.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\shvlzm.exe.mui.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Internet Explorer\Timeline.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-8.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\jfxwebkit.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Omsk.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClient.resources.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\DVD Maker\Shared\Parity.fx.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.nl_ja_4.4.0.v20140623020002.jar.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Internet Explorer\D3DCompiler_47.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticnotification.exsd.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tunis.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\tipresx.dll.mui.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\verify.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Macau.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\tipresx.dll.mui.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\javafx-doclet.jar.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core-windows_visualvm.jar.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\eclipse.inf.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Edmonton.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bogota.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Australia\Hobart.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\tipresx.dll.mui.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Thimphu.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\lib\ext\dnsns.jar.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Microsoft Games\Mahjong\ja-JP\Mahjong.exe.mui.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\tipresx.dll.mui.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_ja_4.4.0.v20140623020002.jar.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe

C:\Users\Admin\AppData\Local\Temp\e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
"C:\Users\Admin\AppData\Local\Temp\e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe"
1⤵
- Drops file in Program Files directory
PID:1320

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-481678230-3773327859-3495911762-1000\desktop.ini.tmp
Filesize
105KB

MD5
3566ec0b0a1adc1a1cb2f30a749df6a1

SHA1
302d04e5eea2f7edfb77c5c0670c5c4ad318cf8a

SHA256
5a2b4b66f65384282974e12920b8c344ca9e5131552a9596969a5fc796d603fb

SHA512
ce4e58811af9eef9b041a7578c4f5f6f63e56114aa888daafd80c45da324f4c450274e93d453ffc07b1ac2badef203912d490fd3045e2fc5cd9fe25a4b1c01b8

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp
Filesize
114KB

MD5
50a9c49001f696568a00f467bba5ce3c

SHA1
5d889e18bf800c639af4fb642c03e5ee3aedbf29

SHA256
97d8c6c1a87b8558eb12a7fde49ac2a42b1fcc1042bdb8558d39cdeb1c8e1792

SHA512
57f891f600202b2d8affe3b0023d8fe17304aa02aa00781c2641d41315028e45cc32b538a5ea2450b9a4a961d510d5b6e1162d78b980ba4b76b7565a96df48af

Download Submit
memory/1320-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1320-162-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads