ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035

Analysis

max time kernel
150s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
Size

68KB
MD5

d97379c6d80ba7b679fdebd94bfac7ee
SHA1

6cf8c8e2cfe54aea587b9386367c3493d42a3ae9
SHA256

ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035
SHA512

d4ef95659c12d3311e056d782ff14b201a661566be01ee5c3d26f5f33e0b914567a4e1b007dcf8a84e8848a082f590022122afa9140e8ed7cef80e742ee1ecf3
SSDEEP

1536:V7Zf/FAxTWY1++PJHJXA/OsIZfzc3/Q8c:fnyiQSoP

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5029) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4628-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp	UPX
C:\Program Files\7-Zip\7-zip.dll.tmp	UPX
behavioral2/memory/4628-1802-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4628-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp	upx
C:\Program Files\7-Zip\7-zip.dll.tmp	upx
behavioral2/memory/4628-1802-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql120.xsl.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationTypes.resources.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\PresentationCore.resources.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\Accessibility.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\ext\meta-index.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Corbel.xml.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ul-oob.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ul-oob.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Drawing.Design.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ppd.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONMAIN.DLL.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightDemiBold.ttf.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ExcelCtxUICellLayoutModel.bin.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-white_scale-80.png.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\PresentationUI.resources.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pt-BR\System.Xaml.resources.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ppd.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Microsoft.Ink.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\UIAutomationClientSideProviders.resources.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.Windows.Forms.Design.Editors.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\WPFEXTENSIONS.DLL.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.White.png.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.Process.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Retail-pl.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8ES.LEX.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Java\jre-1.8\bin\msvcp140_1.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16EnterpriseVL_Bypass30-ul-oob.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\7-Zip\readme.txt.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationFramework.resources.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Reflection.Extensions.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ja\System.Windows.Controls.Ribbon.resources.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\PresentationUI.resources.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaSansDemiBold.ttf.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\7-Zip\History.txt.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipRes.dll.mui.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Client\msvcp120.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\FA000000011.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-180.png.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Grace-ppd.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-pl.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Trial-ppd.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Grace-ul-oob.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ms-my.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\D3DCompiler_47_cor3.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\am.pak.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL086.XML.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssv.dll.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-ul-oob.xrm-ms.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png.tmp	ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe

C:\Users\Admin\AppData\Local\Temp\ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe
"C:\Users\Admin\AppData\Local\Temp\ee3bd21b1fcc82c410da9270b56366f7ad52c688b0b7a92a9afbf8eb4d98d035.exe"
1⤵
- Drops file in Program Files directory
PID:4628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini.tmp
Filesize
68KB

MD5
c883ceee15e617a357c534aac9628d7e

SHA1
42e8f7c88f80e1278c9dcad8300008b83c1bb1e3

SHA256
9a66bffc6c94ad16993a4b6129842d517a33439d6649b904cc851e657f914fe3

SHA512
ea384756a1aea27ad7dbc44d973f2fbfa0fdff7a361753a33495ad0762ef9da5c67ed0e3a7b5300c019916515f2f73f39eb44f82dc9b7a26ef3e6de14911f2cf

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
167KB

MD5
fee2fbea0e9e7d5178e335e5b02e021f

SHA1
8f227e349b801b831b1387790ff8135960bebc96

SHA256
b693ccabf4cf5c02c185527d13fbb73892671f816646ae951763a774e4729e4b

SHA512
e17685cd8633a5a399235a9895886cce1f03450e399ee62c39dadd047b4414070f3f0c5b054b4b235f3a86e5b9e545a9e659c0f2ebe774fd9d98c043ca7bd942

Download Submit
memory/4628-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4628-1802-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download