e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83

Analysis

max time kernel
50s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
Size

41KB
MD5

660b9a459bbbc9d7fb04c42cca34499f
SHA1

a9243222dbda1d819251d0918de0d95effecba0c
SHA256

e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83
SHA512

72919179da217128d3a8715a670f3a87dfc06478d169fc044f130e42884a3c7aa8e763d0163555a7ed4e0d52af10ebd73b7054eb9e502a5baaf8115a60805371
SSDEEP

768:V7Blpf/FAK65euBT37CPKKQSjyJJjtf8WUtf8WGoj9COieQJfoj9COieQJo:V7Zf/FAxTWoJJ2WjWpf1fv

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (1481) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1760-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/1760-1786-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1760-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/1760-1786-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe

description	ioc	process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.InteropServices.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Net.HttpListener.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Cng.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\PresentationFramework.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\InputPersonalization.exe.mui.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Xml.Linq.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.ReaderWriter.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\UIAutomationTypes.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\System\en-US\wab32res.dll.mui.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Data.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Tracing.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\PresentationCore.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Transactions.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Threading.Overlapped.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationTypes.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationCore.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Diagnostics.PerformanceCounter.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\UIAutomationProvider.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hans\UIAutomationProvider.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tabskb.dll.mui.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Ping.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ReachFramework.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hant\UIAutomationClient.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\7-Zip\Lang\va.txt.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\tipskins.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdasql.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-private-l1-1-0.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\Microsoft.VisualBasic.Forms.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationTypes.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\System\ado\msadomd.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\mscorlib.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationCore.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\cs\System.Windows.Forms.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\7-Zip\License.txt.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.Primitives.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\de\UIAutomationProvider.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\PresentationCore.resources.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Buffers.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\7-Zip\descript.ion.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\System\ado\msado21.tlb.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\System\Ole DB\msdatl3.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.TypeConverter.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\7-Zip\Lang\ga.txt.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ComponentModel.DataAnnotations.dll.tmp	e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe

C:\Users\Admin\AppData\Local\Temp\e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe
"C:\Users\Admin\AppData\Local\Temp\e816bf00c7d3937a0fe4a34716de72efbac0bc2c399821daf0dab2076b68eb83.exe"
1⤵
- Drops file in Program Files directory
PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3558294865-3673844354-2255444939-1000\desktop.ini.tmp
Filesize
41KB

MD5
ede03fd4b1bcbb17c33e868022887b4b

SHA1
4e041b437776ff4f9a50a8e1251b435177a794be

SHA256
5ea1b690b78ff6974d31fe1013b2325ae843627aac9cfa076497b0c877b5e4df

SHA512
c415dc2dd56bf5e917d82bbf45fe8b7f59a1b2a118c29d1eb11b522fa26652c5c9320c223501867a30066af382ad45bac7964c36ccdb3fbcf84688fc9dd62510

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
140KB

MD5
9df56c19cf915d8023f66834dd532d2f

SHA1
b7b350a9d5044b221e2bec55861cc8fee81f0c71

SHA256
f38186d99966593ff39d59ba89d1977b45290e496d5d4fa11bbc51d8b041a722

SHA512
b2f6afa2dae007807bec5c1066d130a997da20decba95d6158816386dc5201fca2eca6769abd6687a3493c720fdf74bbe9aeac3e2d6ee16b86450f001638b3f0

Download Submit
memory/1760-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1760-1786-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download