dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/09/2024, 04:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
Size

72KB
MD5

4df0fd34bb3eda870b3ec5b7a717f30a
SHA1

0fb764829bb2df28b783e9180e9a3e1e2513305e
SHA256

dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2
SHA512

b52ef3c74d5fc51627ddcb397ef2b6ab83ab0bc35ce9b8ae6a8061381bae2d850d9d119b2c653b5c722350f1943d30949ca06f2160cd491359abfc4f50fcbee3
SSDEEP

384:yBs7Br5xjL8AgA71FbhvJUfWGUfpa4ma4LGXnlGXnlYAE7/EZ:/7BlpQpARFbhiWbWYqY+

Score

9^/10

discovery ransomware

Malware Config

Signatures

Renames multiple (3730) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\mip.exe.mui.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher_1.1.0.v20131211-1531.jar.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-lib-uihandler.jar.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.json.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\37.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Microsoft Games\Chess\Chess.exe.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.Printing.resources.dll.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\js\cpu.js.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\flyout_background.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Common Files\System\ado\adovbs.inc.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveDrop32x32.gif.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Journal\fr-FR\jnwdui.dll.mui.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\sound.properties.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Iqaluit.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.nl_ja_4.4.0.v20140623020002.jar.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-spi-actions.jar.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\weather.html.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nl.pak.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libreal_plugin.dll.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libbluescreen_plugin.dll.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\7-Zip\Lang\ku.txt.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_s.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Common Files\System\ado\msadomd28.tlb.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\greenStateIcon.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Sidebar\ja-JP\Sidebar.exe.mui.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Belize.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox_1.0.500.v20131211-1531.jar.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-core-kit.xml.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-filesystem-l1-1-0.dll.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libaudiobargraph_a_plugin.dll.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\7-Zip\Lang\el.txt.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\7-Zip\Lang\zh-tw.txt.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_ja.jar.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Media Player\fr-FR\WMPDMC.exe.mui.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\es\System.Data.DataSetExtensions.Resources.dll.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\NextMenuButtonIcon.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiItalic.ttf.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\gtkTSFrame.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-core-kit.xml_hidden.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-3.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_duplicate_plugin.dll.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\10.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Windhoek.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files\Mozilla Firefox\install.log.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif.tmp	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe

C:\Users\Admin\AppData\Local\Temp\dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe
"C:\Users\Admin\AppData\Local\Temp\dccfe83fc032333922fbaeac84ad7dc9d958b7468be83f52a4001b89ea69aab2.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3551809350-4263495960-1443967649-1000\desktop.ini.tmp

Filesize
72KB

MD5
cb92b91bbbcf363b0abc327c8aa0b43c

SHA1
abf6e5979797e9abfd4bbd413cfd754f5269fa45

SHA256
a681ab16aa6431907efc4594391df30126183a443951f6fab8c71a2e85ba8514

SHA512
028fce2ad8f5010b6198d20f0978429fd5c6c336d5e8dab7ea7c61858222ad4d1297b9b5415b9e9a47c09588393cdd4517809fc81ac9390ab658c6ee7255b592

Download Submit
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.xml.tmp

Filesize
81KB

MD5
d9e8eeb0abc6a15bbcf87b0aa014d4dc

SHA1
a439f7d2e5c8353d87ee9c8bd8e2ac11cd216e8f

SHA256
1cafdf3ab2ac47c775cc661624e8310ccb5d48376002e86bab0eef8c1b7ecd13

SHA512
607dde2a7b15e5b8f58632e8bf8eafcf321c246ab9baf322b3c4c595ea8adfec6a323f378bd32b7ca1c78ad5a15ed6786f11afade6519c25334b17ad8548f87a

Download Submit
memory/1724-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1724-74-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download