e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e

Analysis

max time kernel
7s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
Size

105KB
MD5

d9a7a7092710a7fc05bf16ab6ba66cd5
SHA1

a483826af7b897fa0141f38056e23731e39e62d1
SHA256

e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e
SHA512

e7ceac37c616cef4d05c1a6e3ddf990a4aab892ebf89aae35d2db29a20a07c86409273fc2fffdee616afdac598096ba243f20078216e0f053be0c281ff766744
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8zxtjm8szV6VSWtV6Vp:fnyiQSoojmHzV6VSWtV6Vp

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (220) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/1916-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/memory/1916-1644-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1916-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1916-1644-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\nl.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\br.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\vi.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-tw.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\he.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\ko.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\7-zip.chm.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hi-in.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\ro.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\tk.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.da-dk.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\eo.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\sv.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\ca.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\7zCon.sfx.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\co.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\en.ttt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\io.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\CloseOptimize.rle.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\da.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe

C:\Users\Admin\AppData\Local\Temp\e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe
"C:\Users\Admin\AppData\Local\Temp\e3fd49650c582e0bb70435ac6552e393bdef644f8a992491c3d6736fa4379e2e.exe"
1⤵
- Drops file in Program Files directory
PID:1916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
Filesize
105KB

MD5
2aff171dea1ac6bb96898f184e190111

SHA1
15dd1411ec9141bb74ae3cc170acd456f3557cd7

SHA256
3d1e9c9b482b30e3ab5c3869ae9e90857fce96b4182aaa04fbe1b4837eddba06

SHA512
8e24b218b231a147e8bfae996724177e24bcd08a12324b5e0ac2d7a9e4166f854416b53f57af42c73cf449915d5d8044d317831999336e313399a9f09bb29b9e

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
204KB

MD5
7807d796f93bbdfce8b0d9f5d170fdc5

SHA1
bcde3f931c1b59a0d11c1201327ffe95fec9ce33

SHA256
9cfd0ee69276b3bd3301b85c5de6ecc82753a8d2a6db8c230d07b00097aec14f

SHA512
c0f516f159d3830fd5ea593ae0a711ac8474203b636d4f04fd186acb64df59f67167a99dbac03714f66a4f93334b42c594e3b68ea39db5c5a64c4af93f1b6ba0

Download Submit
memory/1916-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1916-1644-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download