9d7b8834d8dd8c1c4eb9ff64535cf26b14e79b41886685705e551b126b44ce40

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bec2a2b2563104b6b2c0ef58bddda6e0N.exe
Size

102KB
MD5

bec2a2b2563104b6b2c0ef58bddda6e0
SHA1

cfe9bc5eea31d9ff8e9b848539409ad6564f524f
SHA256

9d7b8834d8dd8c1c4eb9ff64535cf26b14e79b41886685705e551b126b44ce40
SHA512

e97a2d6c04189022f755427de3a29d1be7dc58ff2882a25a9924f5aa3f8ee1551708a99965515489a454d8f92160c4a1ef6bd400b538a2c197f80e56ebdeab38
SSDEEP

3072:6pWpUFpEhLfyBtPf50FWkFpPDze/qFsxEhLfyBtPf50FWkFpPDze/qFslEhLfyBt:PqFF2Ie+efsim2+

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (2840) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InputPersonalization.exe.mui.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Csi.dll.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Montevideo.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\de-DE\bckgRes.dll.mui.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\fil.pak.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-1.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\scenesscroll.png.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Ojinaga.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-output2.xml.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-compat.xml_hidden.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\tipresx.dll.mui.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui_4.0.100.v20140401-0608.jar.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-threaddump.xml.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\bin\sunec.dll.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-highlight.png.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Novokuznetsk.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\about.html.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.ds_1.4.200.v20131126-2331.jar.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Africa\Windhoek.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\HST10.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Kosrae.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-highlight.png.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.workbench_3.106.1.v20140827-1737.jar.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\bin\unpack200.exe.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\lib\currency.data.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\WindowsBase.resources.dll.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-sampler.jar.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\bin\WindowsAccessBridge-64.dll.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\FreeCell.exe.mui.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_ButtonGraphic.png.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Wake.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.metadataprovider.exsd.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Bahia.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\SpiderSolitaire.exe.mui.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\correct.avi.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Tucuman.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Common Files\System\msadc\handler.reg.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-core-kit.xml.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_ja.jar.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_ja_4.4.0.v20140623020002.jar.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar.tmp	bec2a2b2563104b6b2c0ef58bddda6e0N.exe

C:\Users\Admin\AppData\Local\Temp\bec2a2b2563104b6b2c0ef58bddda6e0N.exe
"C:\Users\Admin\AppData\Local\Temp\bec2a2b2563104b6b2c0ef58bddda6e0N.exe"
1⤵
- Drops file in Program Files directory
PID:2536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\desktop.ini.tmp

Filesize
102KB

MD5
1b932552ca6c2e7537a3397237068021

SHA1
32d518e871ae575d883364fe8457943ed2d66763

SHA256
ff4d1fd6b2f3035db0449d3999ac23835709360bcbc442142b7b07058d90bd8e

SHA512
61823a0e6d6ffefaff06b2446916bb21365a2f7cc3e426b48eed651bc4c33708213e6f4e27f0568827a944aadf4619d80cc00bebcdc5617ab04e0978308db49f

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
111KB

MD5
e8c18e63b17cb500b48a36701ce18302

SHA1
2258e378492766042fde845042ebadd689e6113b

SHA256
9bb8338e276662674664f0ed92e63298b0fb4d44d886faaa7bef1ba2afc53e84

SHA512
e1023bbe7b584f07a29e1db6e1aabf6f46fe6f14a28eea2a9851a34ed91cf24a994b64bf660acd2aa335e93d198ac945ddcea9f354aeb27cfd5c4e18c13402bc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads