Analysis
-
max time kernel
151s -
max time network
203s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 16:06
Static task
static1
Behavioral task
behavioral1
Sample
007a23656af7c77c722c31d092703ec3dac629bbec572ecf1a81d4d952a0a72f.dll
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
007a23656af7c77c722c31d092703ec3dac629bbec572ecf1a81d4d952a0a72f.dll
Resource
win10v2004-20221111-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
007a23656af7c77c722c31d092703ec3dac629bbec572ecf1a81d4d952a0a72f.dll
-
Size
128KB
-
MD5
03ed7f73dcd327e8635763c4b87734e0
-
SHA1
c72daec78120d0843cd682f269515c483c7f5a9c
-
SHA256
007a23656af7c77c722c31d092703ec3dac629bbec572ecf1a81d4d952a0a72f
-
SHA512
363b34a0902c5fa27a2ffcf6aaedddb7065533496c742a8366322397b2141ec574269e238fc3939342cf943d055eae1eb519db90d64e53b3eaf7b886deb583b7
-
SSDEEP
1536:tftPcSErkiYaelPWs8kmQxXUtRrQbea/qLXJXYeLrz3AjWsbqh4rUCE3EBhWvnQT:tlkSqkiYag8yxAXprLA6szEqeQtEul71
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
flow pid Process 2 1712 rundll32.exe 3 1712 rundll32.exe 10 1712 rundll32.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Winmgmt\Parameters\ServiceDll = "C:\\PROGRA~3\\rj7tblfla.pzz" regedit.exe -
resource yara_rule behavioral1/memory/844-56-0x0000000074830000-0x0000000074863000-memory.dmp upx behavioral1/memory/844-59-0x0000000074830000-0x0000000074863000-memory.dmp upx behavioral1/memory/844-60-0x0000000074830000-0x0000000074863000-memory.dmp upx behavioral1/memory/1712-65-0x00000000747F0000-0x0000000074823000-memory.dmp upx behavioral1/memory/1712-68-0x00000000747F0000-0x0000000074823000-memory.dmp upx behavioral1/memory/844-69-0x0000000074830000-0x0000000074863000-memory.dmp upx behavioral1/memory/844-70-0x0000000074830000-0x0000000074863000-memory.dmp upx behavioral1/memory/1712-71-0x00000000747F0000-0x0000000074823000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1712 rundll32.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\PROGRA~3\alflbt7jr.plz rundll32.exe File created C:\PROGRA~3\rj7tblfla.pff rundll32.exe File opened for modification C:\PROGRA~3\rj7tblfla.pff rundll32.exe File created C:\PROGRA~3\rj7tblfla.ctrl rundll32.exe File created C:\PROGRA~3\f27a0a259d4d18a1fce275cebb926cad3ce307290d13c227c77c7fa65632a700.pff rundll32.exe File created C:\PROGRA~3\rj7tblfla.reg rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A58B9F50-7827-11ED-BF27-66397CAA4A34} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Runs .reg file with regedit 1 IoCs
pid Process 2012 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe 1712 rundll32.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 908 iexplore.exe 908 iexplore.exe 908 iexplore.exe 908 iexplore.exe 908 iexplore.exe 908 iexplore.exe 908 iexplore.exe 908 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 908 iexplore.exe 908 iexplore.exe 536 IEXPLORE.EXE 536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 788 wrote to memory of 844 788 rundll32.exe 28 PID 788 wrote to memory of 844 788 rundll32.exe 28 PID 788 wrote to memory of 844 788 rundll32.exe 28 PID 788 wrote to memory of 844 788 rundll32.exe 28 PID 788 wrote to memory of 844 788 rundll32.exe 28 PID 788 wrote to memory of 844 788 rundll32.exe 28 PID 788 wrote to memory of 844 788 rundll32.exe 28 PID 844 wrote to memory of 1712 844 rundll32.exe 29 PID 844 wrote to memory of 1712 844 rundll32.exe 29 PID 844 wrote to memory of 1712 844 rundll32.exe 29 PID 844 wrote to memory of 1712 844 rundll32.exe 29 PID 844 wrote to memory of 1712 844 rundll32.exe 29 PID 844 wrote to memory of 1712 844 rundll32.exe 29 PID 844 wrote to memory of 1712 844 rundll32.exe 29 PID 844 wrote to memory of 908 844 rundll32.exe 30 PID 844 wrote to memory of 908 844 rundll32.exe 30 PID 844 wrote to memory of 908 844 rundll32.exe 30 PID 844 wrote to memory of 908 844 rundll32.exe 30 PID 844 wrote to memory of 908 844 rundll32.exe 30 PID 844 wrote to memory of 908 844 rundll32.exe 30 PID 908 wrote to memory of 536 908 iexplore.exe 32 PID 908 wrote to memory of 536 908 iexplore.exe 32 PID 908 wrote to memory of 536 908 iexplore.exe 32 PID 908 wrote to memory of 536 908 iexplore.exe 32 PID 908 wrote to memory of 688 908 iexplore.exe 33 PID 908 wrote to memory of 688 908 iexplore.exe 33 PID 908 wrote to memory of 688 908 iexplore.exe 33 PID 1712 wrote to memory of 2012 1712 rundll32.exe 34 PID 1712 wrote to memory of 2012 1712 rundll32.exe 34 PID 1712 wrote to memory of 2012 1712 rundll32.exe 34 PID 1712 wrote to memory of 2012 1712 rundll32.exe 34
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\007a23656af7c77c722c31d092703ec3dac629bbec572ecf1a81d4d952a0a72f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\007a23656af7c77c722c31d092703ec3dac629bbec572ecf1a81d4d952a0a72f.dll,#12⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\PROGRA~3\alflbt7jr.plz,GL3003⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe" -s C:\PROGRA~3\rj7tblfla.reg4⤵
- Sets DLL path for service in the registry
- Runs .reg file with regedit
PID:2012
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:908 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:536
-
-
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:688
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD503ed7f73dcd327e8635763c4b87734e0
SHA1c72daec78120d0843cd682f269515c483c7f5a9c
SHA256007a23656af7c77c722c31d092703ec3dac629bbec572ecf1a81d4d952a0a72f
SHA512363b34a0902c5fa27a2ffcf6aaedddb7065533496c742a8366322397b2141ec574269e238fc3939342cf943d055eae1eb519db90d64e53b3eaf7b886deb583b7
-
Filesize
291B
MD57825109c2364c732fd4c2a487fcb6637
SHA179302a1aac39ab7821179ea7ee06a3837e7d3940
SHA256810c0114395287b8bd8ae745d28ea28810d87c7c8c893f59e0613837e78c3060
SHA512eea8f20dd2ee6e0be08df17fa2421ca1e448e4675b3a8115902833efe5c69c2665fe860dc77ec4c85a0158cd8f7c5a8d362ff8a17660e5943ec4e6a422470898
-
Filesize
128KB
MD503ed7f73dcd327e8635763c4b87734e0
SHA1c72daec78120d0843cd682f269515c483c7f5a9c
SHA256007a23656af7c77c722c31d092703ec3dac629bbec572ecf1a81d4d952a0a72f
SHA512363b34a0902c5fa27a2ffcf6aaedddb7065533496c742a8366322397b2141ec574269e238fc3939342cf943d055eae1eb519db90d64e53b3eaf7b886deb583b7