Analysis
-
max time kernel
4294208s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
04-03-2022 13:54
Static task
static1
Behavioral task
behavioral1
Sample
7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0.dll
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0.dll
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0.dll
-
Size
219KB
-
MD5
6c10466ad7c153e7f949fa3c6600b6ac
-
SHA1
5d009f79383a81622eefd8b183efb23fbf96a62f
-
SHA256
7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0
-
SHA512
54a7565a2ce2030b4b865835e13e2de6b7b5bb8f171e7d9db28c3fd1de8d98b7072f50effeb5d15a6ca66a2ff309cbe9b7732154f4a2855ad20c79803f0df33e
Score
6/10
Malware Config
Signatures
-
Drops desktop.ini file(s) 10 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1405931862-909307831-4085185274-1000\desktop.ini rundll32.exe File opened for modification C:\Program Files\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini rundll32.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\fa.pak rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\hi.pak rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros rundll32.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadds.dll rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\hprof.dll rundll32.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Wake rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Nome rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_ja.jar rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Montreal rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe.sig rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationLeft_ButtonGraphic.png rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-core_visualvm.jar rundll32.exe File opened for modification C:\Program Files\Common Files\System\msadc\msadco.dll rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css rundll32.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Anchorage rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\San_Luis rundll32.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClient.resources.dll rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-delete.avi rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\sRGB.pf rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe rundll32.exe File opened for modification C:\Program Files\Common Files\System\ado\msado26.tlb rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Stockholm rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\about.html rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Tmf98E5.tmp rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\MainMenuButtonIcon.png rundll32.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico rundll32.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\es-ES\Minesweeper.exe.mui rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\CIEXYZ.pf rundll32.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Rome rundll32.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\artifacts.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe rundll32.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationClientsideProviders.resources.dll rundll32.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-actions.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\Tmf97AD.tmp rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Menominee rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup-impl.xml rundll32.exe File opened for modification C:\Program Files\Java\jre7\lib\meta-index rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.ini rundll32.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_output\libamem_plugin.dll rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-profiler.xml rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1784 wrote to memory of 1832 1784 rundll32.exe 27 PID 1784 wrote to memory of 1832 1784 rundll32.exe 27 PID 1784 wrote to memory of 1832 1784 rundll32.exe 27 PID 1784 wrote to memory of 1832 1784 rundll32.exe 27 PID 1784 wrote to memory of 1832 1784 rundll32.exe 27 PID 1784 wrote to memory of 1832 1784 rundll32.exe 27 PID 1784 wrote to memory of 1832 1784 rundll32.exe 27
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0.dll,#12⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:1832
-