Analysis
- max time kernel
138s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
10/01/2024, 02:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f5d1d317a47b582228ab67390d9980e.exe
Resource
win7-20231129-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f5d1d317a47b582228ab67390d9980e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 4f5d1d317a47b582228ab67390d9980e.exe
- Size 68KB
- Sample240110-c6s4dadea3
- SHA256 65ed436ca39e0ee7ac2717b432dff73fac15bde3dff37617ad835a696d9cd930
- MD5 4f5d1d317a47b582228ab67390d9980e
- SHA1 7c7f691c1c1baf86a1020dfaeb88e68f7a1c6e67
- SHA512 cadf1660b889949977c7fb303348d97531bd024cd42445ae58b9b44f67ae32406b3413f8c8983a83d8a457dd3c6331e8927091235cd987257dd2e81d0e946a6c
- SSDEEP 1536:gtq94xqLCCPaTavGeHwnfxO6cVMS7r9KCYa6y8v9cb:uqda+V6cVMS7r9+a6yY9cb
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 4f5d1d317a47b582228ab67390d9980e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\llajyn_df = "C:\\Windows\\system\\lljyn090101.exe" 4f5d1d317a47b582228ab67390d9980e.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 4f5d1d317a47b582228ab67390d9980e.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\system\lljyn090101.exe 4f5d1d317a47b582228ab67390d9980e.exe File opened for modification C:\Windows\system\lljyn090101.exe 4f5d1d317a47b582228ab67390d9980e.exe File opened for modification C:\Windows\system\llbjyn32bb.dll 4f5d1d317a47b582228ab67390d9980e.exe File created C:\Windows\system\llbjyn32bb.dll 4f5d1d317a47b582228ab67390d9980e.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31081326" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Check_Associations = "no" 4f5d1d317a47b582228ab67390d9980e.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31081326" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3263419784" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3263419784" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{EA7AD866-AF61-11EE-B6AD-CE055DF4442A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{F211F87D-AF61-11EE-B6AD-CE055DF4442A}.dat = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete iexplore.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 4352 PING.EXE - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3552 4f5d1d317a47b582228ab67390d9980e.exe 3552 4f5d1d317a47b582228ab67390d9980e.exe 3552 4f5d1d317a47b582228ab67390d9980e.exe 3552 4f5d1d317a47b582228ab67390d9980e.exe 3552 4f5d1d317a47b582228ab67390d9980e.exe 3552 4f5d1d317a47b582228ab67390d9980e.exe 3552 4f5d1d317a47b582228ab67390d9980e.exe 3552 4f5d1d317a47b582228ab67390d9980e.exe 3552 4f5d1d317a47b582228ab67390d9980e.exe 3552 4f5d1d317a47b582228ab67390d9980e.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3552 4f5d1d317a47b582228ab67390d9980e.exe Token: SeDebugPrivilege 3552 4f5d1d317a47b582228ab67390d9980e.exe Token: SeDebugPrivilege 3552 4f5d1d317a47b582228ab67390d9980e.exe Token: SeDebugPrivilege 3552 4f5d1d317a47b582228ab67390d9980e.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1464 iexplore.exe 1464 iexplore.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3552 wrote to memory of 1464 3552 4f5d1d317a47b582228ab67390d9980e.exe 94 PID 3552 wrote to memory of 1464 3552 4f5d1d317a47b582228ab67390d9980e.exe 94 PID 1464 wrote to memory of 4588 1464 iexplore.exe 97 PID 1464 wrote to memory of 4588 1464 iexplore.exe 97 PID 1464 wrote to memory of 4588 1464 iexplore.exe 97 PID 3552 wrote to memory of 1464 3552 4f5d1d317a47b582228ab67390d9980e.exe 94 PID 3552 wrote to memory of 656 3552 4f5d1d317a47b582228ab67390d9980e.exe 99 PID 3552 wrote to memory of 656 3552 4f5d1d317a47b582228ab67390d9980e.exe 99 PID 3552 wrote to memory of 656 3552 4f5d1d317a47b582228ab67390d9980e.exe 99 PID 656 wrote to memory of 4352 656 cmd.exe 101 PID 656 wrote to memory of 4352 656 cmd.exe 101 PID 656 wrote to memory of 4352 656 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f5d1d317a47b582228ab67390d9980e.exe"C:\Users\Admin\AppData\Local\Temp\4f5d1d317a47b582228ab67390d9980e.exe"1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\program files\internet explorer\iexplore.exe"C:\program files\internet explorer\iexplore.exe"2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1464 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
PID:4588
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\dfDelmlljy.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
PID:4352
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\lljyndf16.ini
- Size 85B
- SHA256 929674867dff75548664ef62a39d27d38522ecb1bae8d4fc2b3c2ea9333e2d85
- MD5 9fce7039e13215513a7fa2bf693bd6f3
- SHA1 1188012bf423dc1730f1dfe8fa7c613967a14305
- SHA512 cfeb816ebdb625f30a14147cc2aacc8e43a2f429e61fd7600b2ffba508d43a6578f6e83479df179c5bdfea636f6dc944a13433f6a23538783274449c4b23a9ca
- MD5 SHA1 SHA512
- Path C:\dfDelmlljy.bat
- Size 205B
- SHA256 19828557383a47e70ab960b0559fb676b1d498cbef39e56cee384fc93faa228a
- MD5 18f923fa806b1dfdafc27c982170ede2
- SHA1 cab56a4707844537d5ffb8a4c762c021a2ab6304
- SHA512 8a98f69ed0691976952e0bcfadce39a27ea8f37d76f5fcac799be1ac3dcb1d585b6e1b9aac9faf20d97456e505eb91a49d2702ef11305cb4f2fc971d78e7ebdb
- MD5 SHA1 SHA512