Analysis
-
max time kernel
152s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 00:35
Static task
static1
Behavioral task
behavioral1
Sample
76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe
-
Size
204KB
-
MD5
6b1c22e59578f85873b2ff88d539b691
-
SHA1
a0a7aeee096fc5187f860cfa6ec1bc0b506262a2
-
SHA256
76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083
-
SHA512
ff18b9e486742339a144630db3c92382e214e9ed8a9e6d3a2010fe80c44dcdd7bebd3cca0b28f1b33c258c4af315ac76efdc8f9b5a0c5eb5e70a932359059e11
-
SSDEEP
3072:xgEtvXPR2p3zf+sJZY1Pm+Auw3jjOPyzgKxycD12XHvGcVdNQUQ:Rfgz2sJZC3SjBzbZWw
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ljsiob.exe -
Executes dropped EXE 1 IoCs
pid Process 1940 ljsiob.exe -
Loads dropped DLL 2 IoCs
pid Process 1408 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe 1408 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe -
Adds Run key to start application 2 TTPs 53 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /X" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /W" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /V" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /P" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /J" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /S" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /k" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /f" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /N" ljsiob.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /R" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /E" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /z" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /n" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /G" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /g" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /t" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /D" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /h" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /x" ljsiob.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /a" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /d" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /m" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /i" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /K" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /c" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /I" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /w" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /s" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /u" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /M" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /p" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /b" 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /U" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /l" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /F" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /L" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /Q" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /Z" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /T" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /C" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /A" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /e" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /y" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /v" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /o" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /j" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /H" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /Y" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /O" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /q" ljsiob.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ljsiob = "C:\\Users\\Admin\\ljsiob.exe /b" ljsiob.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1408 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe 1940 ljsiob.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1408 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe 1940 ljsiob.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1408 wrote to memory of 1940 1408 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe 26 PID 1408 wrote to memory of 1940 1408 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe 26 PID 1408 wrote to memory of 1940 1408 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe 26 PID 1408 wrote to memory of 1940 1408 76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe"C:\Users\Admin\AppData\Local\Temp\76213a41d186bb57f4eec68540d892beecdea637e6d830600427a8568184b083.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\ljsiob.exe"C:\Users\Admin\ljsiob.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1940
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD598c2556c13065143f2fb501a4eeac6a5
SHA195150dbbe5ddcd357cff2b984537c1e1eb3a8a2a
SHA256b37c12fb559f6aefb2064201141239b47276236d1d23fecbe1e300550d2130a0
SHA51274802cae640f332895781be80bf0ea1e381c919c036a696ac99eb69506f7cd85fd796d4b75e25ab1dd7d74ed501229f67819f28f1a3764a173c8516454a3e8c9
-
Filesize
204KB
MD598c2556c13065143f2fb501a4eeac6a5
SHA195150dbbe5ddcd357cff2b984537c1e1eb3a8a2a
SHA256b37c12fb559f6aefb2064201141239b47276236d1d23fecbe1e300550d2130a0
SHA51274802cae640f332895781be80bf0ea1e381c919c036a696ac99eb69506f7cd85fd796d4b75e25ab1dd7d74ed501229f67819f28f1a3764a173c8516454a3e8c9
-
Filesize
204KB
MD598c2556c13065143f2fb501a4eeac6a5
SHA195150dbbe5ddcd357cff2b984537c1e1eb3a8a2a
SHA256b37c12fb559f6aefb2064201141239b47276236d1d23fecbe1e300550d2130a0
SHA51274802cae640f332895781be80bf0ea1e381c919c036a696ac99eb69506f7cd85fd796d4b75e25ab1dd7d74ed501229f67819f28f1a3764a173c8516454a3e8c9
-
Filesize
204KB
MD598c2556c13065143f2fb501a4eeac6a5
SHA195150dbbe5ddcd357cff2b984537c1e1eb3a8a2a
SHA256b37c12fb559f6aefb2064201141239b47276236d1d23fecbe1e300550d2130a0
SHA51274802cae640f332895781be80bf0ea1e381c919c036a696ac99eb69506f7cd85fd796d4b75e25ab1dd7d74ed501229f67819f28f1a3764a173c8516454a3e8c9