965776dc658c84410096ff846182c9bf402b04a437cf31db432cc5579be2fda7

Analysis

max time kernel
134s
max time network
139s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 00:55

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

965776dc658c84410096ff846182c9bf402b04a437cf31db432cc5579be2fda7.dll
Size

147KB
MD5

264313c0e5e6060ddffc07df8a07ea70
SHA1

91b7a6ba877cf4631164b65227b5ccc865fe34dd
SHA256

965776dc658c84410096ff846182c9bf402b04a437cf31db432cc5579be2fda7
SHA512

0cca84fa69fd2bf01f37d297e7b742c27ef3ca55fddc6c6e272c52ddeb7ead0337dea93b07a02705862d25d5915430984c0be3ec8c45400f547647d87ec542a6
SSDEEP

3072:8mtVm+0Z8gm+gIViTZQBzZGGXxWZcgKNYw1sC1mmVXGI:lVm+0qgHkSvxEcigVl

Score

8^/10

persistence

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
1	1132	rundll32.exe
2	1132	rundll32.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDll = "C:\\PROGRA~3\\lcb8z4b7t.pzz"	regedit.exe

Loads dropped DLL 1 IoCs

pid	Process
1132	rundll32.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\PROGRA~3\lcb8z4b7t.ctrl	rundll32.exe
File created	C:\PROGRA~3\lcb8z4b7t.reg	rundll32.exe
File created	C:\PROGRA~3\t7b4z8bcl.plz	rundll32.exe
File created	C:\PROGRA~3\lcb8z4b7t.pff	rundll32.exe
File opened for modification	C:\PROGRA~3\lcb8z4b7t.pff	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs .reg file with regedit 1 IoCs

pid	Process
1308	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe
1132	rundll32.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1132	rundll32.exe
Token: 33	1456	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1456	AUDIODG.EXE
Token: 33	1456	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1456	AUDIODG.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1124	1632	rundll32.exe	28
PID 1632 wrote to memory of 1124	1632	rundll32.exe	28
PID 1632 wrote to memory of 1124	1632	rundll32.exe	28
PID 1632 wrote to memory of 1124	1632	rundll32.exe	28
PID 1632 wrote to memory of 1124	1632	rundll32.exe	28
PID 1632 wrote to memory of 1124	1632	rundll32.exe	28
PID 1632 wrote to memory of 1124	1632	rundll32.exe	28
PID 1124 wrote to memory of 1132	1124	rundll32.exe	29
PID 1124 wrote to memory of 1132	1124	rundll32.exe	29
PID 1124 wrote to memory of 1132	1124	rundll32.exe	29
PID 1124 wrote to memory of 1132	1124	rundll32.exe	29
PID 1124 wrote to memory of 1132	1124	rundll32.exe	29
PID 1124 wrote to memory of 1132	1124	rundll32.exe	29
PID 1124 wrote to memory of 1132	1124	rundll32.exe	29
PID 1132 wrote to memory of 1308	1132	rundll32.exe	30
PID 1132 wrote to memory of 1308	1132	rundll32.exe	30
PID 1132 wrote to memory of 1308	1132	rundll32.exe	30
PID 1132 wrote to memory of 1308	1132	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\965776dc658c84410096ff846182c9bf402b04a437cf31db432cc5579be2fda7.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\965776dc658c84410096ff846182c9bf402b04a437cf31db432cc5579be2fda7.dll,#1
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe C:\PROGRA~3\t7b4z8bcl.plz,GL300
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Windows\SysWOW64\regedit.exe
      C:\Windows\regedit.exe -s C:\PROGRA~3\lcb8z4b7t.reg
      4⤵
      Sets DLL path for service in the registry
      Runs .reg file with regedit
      PID:1308

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1800

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x544
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\t7b4z8bcl.plz

Filesize
147KB

MD5
264313c0e5e6060ddffc07df8a07ea70

SHA1
91b7a6ba877cf4631164b65227b5ccc865fe34dd

SHA256
965776dc658c84410096ff846182c9bf402b04a437cf31db432cc5579be2fda7

SHA512
0cca84fa69fd2bf01f37d297e7b742c27ef3ca55fddc6c6e272c52ddeb7ead0337dea93b07a02705862d25d5915430984c0be3ec8c45400f547647d87ec542a6

Download Submit
C:\ProgramData\lcb8z4b7t.reg

Filesize
291B

MD5
f3de68d2caa9b802008b6572432ea624

SHA1
ba08d79d02b94cf5a49273bcf4a6c512de9adfcd

SHA256
199c47f47516d2787d6449bda61219653263ef6119f2729a31cfc4489885604c

SHA512
a00dbd48e14f0424db1172ac27171cbdf1a0f160438951c2aac0540184628b62b53b0f310af2c69976c453e90cbbbe754c0481d7d2b9c869af20ed3a8181dfd4

Download Submit
\PROGRA~3\t7b4z8bcl.plz

Filesize
147KB

MD5
264313c0e5e6060ddffc07df8a07ea70

SHA1
91b7a6ba877cf4631164b65227b5ccc865fe34dd

SHA256
965776dc658c84410096ff846182c9bf402b04a437cf31db432cc5579be2fda7

SHA512
0cca84fa69fd2bf01f37d297e7b742c27ef3ca55fddc6c6e272c52ddeb7ead0337dea93b07a02705862d25d5915430984c0be3ec8c45400f547647d87ec542a6

Download Submit
memory/1124-59-0x0000000075410000-0x000000007543B000-memory.dmp

Filesize
172KB

Download
memory/1124-56-0x0000000075410000-0x000000007543B000-memory.dmp

Filesize
172KB

Download
memory/1124-55-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1132-64-0x00000000753E0000-0x000000007540B000-memory.dmp

Filesize
172KB

Download
memory/1132-67-0x00000000753E0000-0x000000007540B000-memory.dmp

Filesize
172KB

Download
memory/1132-68-0x00000000753E0000-0x000000007540B000-memory.dmp

Filesize
172KB

Download
memory/1132-73-0x00000000753E0000-0x000000007540B000-memory.dmp

Filesize
172KB

Download
memory/1800-72-0x000007FEFC611000-0x000007FEFC613000-memory.dmp

Filesize
8KB

Download