Analysis
-
max time kernel
131s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
0fa0711d0f8c90b5f2aab38681977074905fd967d7857e5b02be0e6334360042.dll
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
0fa0711d0f8c90b5f2aab38681977074905fd967d7857e5b02be0e6334360042.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
4 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
0fa0711d0f8c90b5f2aab38681977074905fd967d7857e5b02be0e6334360042.dll
-
Size
115KB
-
MD5
280092290910d3c1278c75e6f8fea3b0
-
SHA1
1117c7b2a7daab01aff22ffa9b01691409f9d4f1
-
SHA256
0fa0711d0f8c90b5f2aab38681977074905fd967d7857e5b02be0e6334360042
-
SHA512
5d442eaf4d69eb04438d6b1382cf1e26f9e3b7883c14c05b578a78d79a53955a053d8faa4524e2da670466ad2633bc61d1387e904eb6bae9dad649f78b366ceb
-
SSDEEP
3072:kjdM0p+WA39lD0uArty4WGdnbAhH2qUrvSUzqqEHtAl:6+b9muARLuHtUbBqBg
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 1 1352 rundll32.exe 4 1352 rundll32.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDll = "C:\\PROGRA~3\\eebjjlc.pzz" regedit.exe -
resource yara_rule behavioral1/memory/1980-56-0x00000000747E0000-0x0000000074813000-memory.dmp upx behavioral1/memory/1980-59-0x00000000747E0000-0x0000000074813000-memory.dmp upx behavioral1/memory/1352-64-0x0000000074690000-0x00000000746C3000-memory.dmp upx behavioral1/memory/1352-67-0x0000000074690000-0x00000000746C3000-memory.dmp upx behavioral1/memory/1980-68-0x00000000747E0000-0x0000000074813000-memory.dmp upx behavioral1/memory/1352-69-0x0000000074690000-0x00000000746C3000-memory.dmp upx behavioral1/memory/1352-76-0x0000000074690000-0x00000000746C3000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1352 rundll32.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\PROGRA~3\2400634336e0eb20b5e7587d769df50947077918683baa2f5b09c8f0d1170af0.pff rundll32.exe File created C:\PROGRA~3\eebjjlc.reg rundll32.exe File created C:\PROGRA~3\cljjbee.plz rundll32.exe File created C:\PROGRA~3\eebjjlc.pff rundll32.exe File opened for modification C:\PROGRA~3\eebjjlc.pff rundll32.exe File created C:\PROGRA~3\eebjjlc.ctrl rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{424F9BF1-7825-11ED-AF6B-DA7E66F9F45D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377398691" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2036 regedit.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe 1352 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeShutdownPrivilege 1352 rundll32.exe Token: 33 1964 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1964 AUDIODG.EXE Token: 33 1964 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1964 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 1288 iexplore.exe 1288 iexplore.exe 1288 iexplore.exe 1288 iexplore.exe 1288 iexplore.exe 1288 iexplore.exe 1288 iexplore.exe 1288 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1288 iexplore.exe 1288 iexplore.exe 1060 IEXPLORE.EXE 1060 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1976 wrote to memory of 1980 1976 rundll32.exe 26 PID 1980 wrote to memory of 1352 1980 rundll32.exe 27 PID 1980 wrote to memory of 1352 1980 rundll32.exe 27 PID 1980 wrote to memory of 1352 1980 rundll32.exe 27 PID 1980 wrote to memory of 1352 1980 rundll32.exe 27 PID 1980 wrote to memory of 1352 1980 rundll32.exe 27 PID 1980 wrote to memory of 1352 1980 rundll32.exe 27 PID 1980 wrote to memory of 1352 1980 rundll32.exe 27 PID 1980 wrote to memory of 1288 1980 rundll32.exe 28 PID 1980 wrote to memory of 1288 1980 rundll32.exe 28 PID 1980 wrote to memory of 1288 1980 rundll32.exe 28 PID 1980 wrote to memory of 1288 1980 rundll32.exe 28 PID 1980 wrote to memory of 1288 1980 rundll32.exe 28 PID 1980 wrote to memory of 1288 1980 rundll32.exe 28 PID 1288 wrote to memory of 1060 1288 iexplore.exe 30 PID 1288 wrote to memory of 1060 1288 iexplore.exe 30 PID 1288 wrote to memory of 1060 1288 iexplore.exe 30 PID 1288 wrote to memory of 1060 1288 iexplore.exe 30 PID 1288 wrote to memory of 760 1288 iexplore.exe 31 PID 1288 wrote to memory of 760 1288 iexplore.exe 31 PID 1288 wrote to memory of 760 1288 iexplore.exe 31 PID 1352 wrote to memory of 2036 1352 rundll32.exe 32 PID 1352 wrote to memory of 2036 1352 rundll32.exe 32 PID 1352 wrote to memory of 2036 1352 rundll32.exe 32 PID 1352 wrote to memory of 2036 1352 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0fa0711d0f8c90b5f2aab38681977074905fd967d7857e5b02be0e6334360042.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0fa0711d0f8c90b5f2aab38681977074905fd967d7857e5b02be0e6334360042.dll,#12⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\PROGRA~3\cljjbee.plz,GL3003⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe" -s C:\PROGRA~3\eebjjlc.reg4⤵
- Sets DLL path for service in the registry
- Runs .reg file with regedit
PID:2036
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1060
-
-
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:760
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:452
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5741⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:2016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD5280092290910d3c1278c75e6f8fea3b0
SHA11117c7b2a7daab01aff22ffa9b01691409f9d4f1
SHA2560fa0711d0f8c90b5f2aab38681977074905fd967d7857e5b02be0e6334360042
SHA5125d442eaf4d69eb04438d6b1382cf1e26f9e3b7883c14c05b578a78d79a53955a053d8faa4524e2da670466ad2633bc61d1387e904eb6bae9dad649f78b366ceb
-
Filesize
279B
MD56ab8236386949c7e39bdbb0affc8f53a
SHA17b4372bbf2f512d2f4c77e282cf5dc4726313012
SHA256c792d2deb5260fc601e007c845137529d09ccf551bc3027cb3c6b38ea8ccb90e
SHA512005a75c1dcbb7e3c5379f1f3de02da18998eabe238a7ec5501d096fa9459608848350834b591ec568321e9c58e3ca0bbed756a5f09abae1452d64c68d1bb91fd
-
Filesize
601B
MD5c1fd2d0c2d786ee58bb110e22de3fa77
SHA186e5ac7c4cb0b8444d767fe929b91fefead8cf02
SHA25634cad6b2709ed8b0071abdd7573e59e58ce7a4c4cdb91e6bea1642a609dba81a
SHA5125676e679e70ebf3b2e8d5bafc70b474355e42e9f213d9aea33d027f08172facd9db3b63c78e75d592f703d154fa0ea7d606c2146907cf7d8ea4e77c658fd24f2
-
Filesize
115KB
MD5280092290910d3c1278c75e6f8fea3b0
SHA11117c7b2a7daab01aff22ffa9b01691409f9d4f1
SHA2560fa0711d0f8c90b5f2aab38681977074905fd967d7857e5b02be0e6334360042
SHA5125d442eaf4d69eb04438d6b1382cf1e26f9e3b7883c14c05b578a78d79a53955a053d8faa4524e2da670466ad2633bc61d1387e904eb6bae9dad649f78b366ceb