dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3

General

Target

dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
Size

79KB
MD5

0407aac52d67e182a96d87111c3c37d3
SHA1

302c38e6909ef30073706a7dd008cb5c30ecc4e8
SHA256

dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3
SHA512

e70a48cf0e3017c4e6d59894a991e7e606b9e0a20f5f0165d9fd160367623c4c2b8ac5d177c9e29580bf8ed9654e01b503ccc0f7bf8ad7c9e5f316b939e55939
SSDEEP

768:W7BlpDpARFbhYQkQjjLaMaRRpi1xnRpi1xOYJIJDYJIJMFhWFhCmDpBIjsZORReR:W7ZDpApYbWj2WTWJe+e/qX4

Score

9^/10

ransomware

Malware Config

Signatures

Renames multiple (4860) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

Processes:

dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe

description	ioc	process
File created	C:\Program Files\7-Zip\Lang\ms.txt.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\InitializeDebug.jpeg.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-bridge-office.xrm-ms.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MEDIA\TYPE.WAV.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemDrawing.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-convert-l1-1-0.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-phn.xrm-ms.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pl\UIAutomationProvider.resources.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Retail-ppd.xrm-ms.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Extensions.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\msdaprsr.dll.mui.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\UIAutomationProvider.resources.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\hostpolicy.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Google\Chrome\Application\110.0.5481.104\nacl_irt_x86_64.nexe.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\System.Windows.Forms.Design.resources.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\WindowsFormsIntegration.resources.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Reflection.Metadata.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Resources.ResourceManager.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Controls.Ribbon.resources.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\vcruntime140_cor3.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Forms.resources.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Grace-ppd.xrm-ms.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.OData.Edm.NetFX35.V7.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription1-ppd.xrm-ms.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.CSharp.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Numerics.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.X509Certificates.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\unicode.md.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Document.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\as90.xsl.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Drawing.Primitives.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-pl.xrm-ms.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\WWINTL.DLL.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\7-Zip\Lang\an.txt.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Specialized.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Diagnostics.DiagnosticSource.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationUI.resources.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Algorithms.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\es\System.Windows.Forms.Design.resources.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\ReachFramework.resources.dll.tmp	dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe

C:\Users\Admin\AppData\Local\Temp\dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe
"C:\Users\Admin\AppData\Local\Temp\dcd118bb56b14a94383b8f5d03aeac61466a1647fd8fa8eb55909a38bcfc08b3.exe"
1⤵
- Drops file in Program Files directory
PID:3148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-540404634-651139247-2967210625-1000\desktop.ini.tmp
Filesize
79KB

MD5
edbd48743a5e6f6e6da1d6ec8b2e8a90

SHA1
287f579f10bb0e0732a78854ef9a2aa52910059c

SHA256
ca18848b82c0110f8245e265eb87ee012452ff4b078b73332c9b6db9f5c20f5e

SHA512
d81626cc4be68db8556bb54f0324ec922a2aebe864c801ea524883c5e674286a310df8a07eb2d1bddd5287e01bff2ae3e83498110aa9d64b1cb7325c9ebdb62a

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp
Filesize
178KB

MD5
61717a30fd85a367fe15d361ba29830c

SHA1
ec53894b6a63897f9be94af41edc1e32c2d20e94

SHA256
9efe7144367bb06f27d3897ef97f25dc9944b44b1b537e728c887854f7803c70

SHA512
aa83124500330fb649374ae0cbb06b8e0ab3c4d5cad5b3d8400ff1ceb135b610af13a9dd243ea766c7027de6b99144ce6670fd783400a131cfa123e6fab526d9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads