Analysis
-
max time kernel
148s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
04-03-2022 13:54
Static task
static1
Behavioral task
behavioral1
Sample
7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0.dll
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0.dll
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0.dll
-
Size
219KB
-
MD5
6c10466ad7c153e7f949fa3c6600b6ac
-
SHA1
5d009f79383a81622eefd8b183efb23fbf96a62f
-
SHA256
7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0
-
SHA512
54a7565a2ce2030b4b865835e13e2de6b7b5bb8f171e7d9db28c3fd1de8d98b7072f50effeb5d15a6ca66a2ff309cbe9b7732154f4a2855ad20c79803f0df33e
Score
6/10
Malware Config
Signatures
-
Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-790714498-1549421491-1643397139-1000\desktop.ini rundll32.exe File opened for modification C:\Program Files\desktop.ini rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI rundll32.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.ScriptDom.dll rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.Recommendation.Common.dll rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-140.png rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Tmf975B.tmp rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\plugin.xml rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppvIsvSubsystems64.dll rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-pl.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoianetutil.dll rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Tmf995F.tmp rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui rundll32.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\msader15.dll.mui rundll32.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\win32_LinkNoDrop32x32.gif rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\TellMePowerPoint.nrr rundll32.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt rundll32.exe File opened for modification C:\Program Files\Common Files\System\es-ES\Tmf9BC0.tmp rundll32.exe File opened for modification C:\Program Files\Common Files\System\msadc\Tmf9BD0.tmp rundll32.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-awt.jar rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\libGLESv2.dll rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\lv.pak rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\JAWTAccessBridge-64.dll rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\ECLIPSE_.SF rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\jfluid-server-15.jar rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config rundll32.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\security\blacklisted.certs rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-ppd.xrm-ms rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-loaders.xml rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest4-ppd.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial5-pl.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-180.png rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest5-pl.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-pl.xrm-ms rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll rundll32.exe File opened for modification C:\Program Files\Common Files\System\it-IT\Tmf9BD0.tmp rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\snmp.acl.template rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\msipc.dll.mui rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_OEM_Perp-pl.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_KMS_ClientC2R-ul.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Storage.XmlSerializers.dll rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_ja.jar rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ORGCINTL.DLL rundll32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe rundll32.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\.lastModified rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\client-issuance-ul.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\sv.pak rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ppd.xrm-ms rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms rundll32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-threaddump_ja.jar rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3948 wrote to memory of 1492 3948 rundll32.exe 56 PID 3948 wrote to memory of 1492 3948 rundll32.exe 56 PID 3948 wrote to memory of 1492 3948 rundll32.exe 56
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7bcd4ec18fc4a56db30e0aaebd44e2988f98f7b5d8c14f6689f650b4f11e16c0.dll,#12⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:1492
-