a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1

Analysis

max time kernel
136s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
Size

66KB
MD5

61bfae219c83dd366263b8f8c7cdc15c
SHA1

f072e88fc067a1a481ebe3d7acaa02ab864243e1
SHA256

a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1
SHA512

daf59a96987db1d86f6295680c3b44d5cadb3e632f76cc55ee2ff390ab4e63f278c9c3f6fc74a8bccafe2e1b3cbda0295958fabfbaf6c33b37ce829d9665d5a4
SSDEEP

1536:8XBdQbwuqFYyItSuHHkeiHR8HRACwNdQleB44978aGSWEwVsf:0DFYtQuHHkeDxACU/Bh78aGRVe

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\llajyn_df = "C:\\Windows\\system\\lljyn081024.exe"	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system\lljyn081024.exe	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
File opened for modification	C:\Windows\system\lljyn081024.exe	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
File opened for modification	C:\Windows\system\llbjyn32bb.dll	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
File created	C:\Windows\system\llbjyn32bb.dll	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001928"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377518459"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{2A27A30B-793C-11ED-A0EE-D64C4877EDD1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no"	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31001928"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31001928"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4293427594"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4274364833"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4274364833"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4504	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
388	iexplore.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
Token: SeDebugPrivilege	5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
Token: SeDebugPrivilege	5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
Token: SeDebugPrivilege	5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
388	iexplore.exe
388	iexplore.exe
5060	IEXPLORE.EXE
5060	IEXPLORE.EXE
5060	IEXPLORE.EXE
5060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 388	5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe	83
PID 5028 wrote to memory of 388	5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe	83
PID 388 wrote to memory of 5060	388	iexplore.exe	84
PID 388 wrote to memory of 5060	388	iexplore.exe	84
PID 388 wrote to memory of 5060	388	iexplore.exe	84
PID 5028 wrote to memory of 388	5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe	83
PID 5028 wrote to memory of 948	5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe	87
PID 5028 wrote to memory of 948	5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe	87
PID 5028 wrote to memory of 948	5028	a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe	87
PID 948 wrote to memory of 4504	948	cmd.exe	89
PID 948 wrote to memory of 4504	948	cmd.exe	89
PID 948 wrote to memory of 4504	948	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe
"C:\Users\Admin\AppData\Local\Temp\a35c504638493cd13c1407423d47c33c8dec33003f6ebe8557287a335d53f4b1.exe"
1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028
- C:\program files\internet explorer\iexplore.exe
  "C:\program files\internet explorer\iexplore.exe"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:388 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\dfDelmlljy.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
8b90c80540ac0b7f86a00f00c7adb0e5

SHA1
a83d1a28ce3a71303dc0eb7359182812d74539c8

SHA256
47d6c62ae69a38a716da5db2d4b4c95193dc1dcbebef3c55dea8c0cfb13ea256

SHA512
546494549dbf6e3c8fc547c3269a3564c6ba6e34ba66df238f31f6b53a35f9b46f5973deb38c7a686ee89b484b95cb0be1c4b49b5c771d38d80d42eb66885cd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
5a06c601755c049a3326efa76d48f390

SHA1
5c148dcb7ecd0ba32329e5e1b8cfa6f2c83dc365

SHA256
7850df9234dd5738866c8770e4cf75860204fc2ebf0f8eabdabdfdee72e0516d

SHA512
6b57620ed59ca750cf0c44bedaeec16d45e6195b9dc63f68380df2a880f5b96b24603daf3ca0f35143d2b438e9572359a3a3251f53fb76eff6482b73691fc30a

Download Submit
C:\dfDelmlljy.bat

Filesize
269B

MD5
c4e40630e3c6c6be2052384b70789516

SHA1
aa75b64900bd9ecd2b7e0f79d80c2ce99757eda3

SHA256
4843fa331cee057fda25bb3238bddb092704de886d1bfd413211f1418a466ee0

SHA512
13e3c0ffc18c565e6315c5b3056ccac491dec52926afb4638935bf02e666b5d622d256fe304414ebd397158891b6e40bc609e6f66b1ff9af1b6d023e12ac604c

Download Submit
memory/948-135-0x0000000000000000-mapping.dmp

Download
memory/4504-137-0x0000000000000000-mapping.dmp

Download