cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317

General

Target

cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
Size

368KB
MD5

e0e79354e6b6234d87efdbf52c232657
SHA1

b4f62408f5e143cb8a2d82cfdbc6b7d4021a5580
SHA256

cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317
SHA512

e9bfc75304e7f962f7ccacd46878b58a72782bc73a7d8960edf1dbfc129033206f3abae7f9331bd9fb428213caa4e343aabd6e7b195e992dbe6f4257fd3f918a
SSDEEP

1536:s0PkF42Z/Hmkiw+667MIBf28zPJtC6IoD/QWgxektFAo11Sq:TPA42mLf2RxIfq

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

lijir.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lijir.exe

Executes dropped EXE 1 IoCs

Processes:

lijir.exe

pid process

1740 lijir.exe

Loads dropped DLL 2 IoCs

Processes:

cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe

pid	process
3012	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
3012	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

lijir.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /J"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /t"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /S"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /a"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /F"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /W"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /u"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /r"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /B"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /g"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /q"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /Z"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /Y"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /v"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /G"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /K"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /A"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /Q"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /L"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /c"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /h"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /d"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /n"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /z"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /N"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /M"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /E"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /X"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /R"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /T"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /C"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /j"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /f"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /I"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /o"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /w"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /O"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /i"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /k"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /U"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /D"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /l"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /s"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /p"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /e"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /V"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /m"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /y"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /H"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /P"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /x"	lijir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\lijir = "C:\\Users\\Admin\\lijir.exe /b"	lijir.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exelijir.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lijir.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

lijir.exe

pid	process
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe
1740	lijir.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exelijir.exe

pid process

3012 cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
1740 lijir.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exelijir.exe

description	pid	process	target process
PID 3012 wrote to memory of 1740	3012	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe	lijir.exe
PID 3012 wrote to memory of 1740	3012	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe	lijir.exe
PID 3012 wrote to memory of 1740	3012	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe	lijir.exe
PID 3012 wrote to memory of 1740	3012	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe	lijir.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
PID 1740 wrote to memory of 3012	1740	lijir.exe	cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe

C:\Users\Admin\AppData\Local\Temp\cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe
"C:\Users\Admin\AppData\Local\Temp\cff19385f9abc2d4c672c64c94ae4ebea2dd74e5abd17464f08809d3aebe6317.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\lijir.exe
  "C:\Users\Admin\lijir.exe"
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\lijir.exe

Filesize
368KB

MD5
98cae4304c852312b10cb0f0dc8df057

SHA1
438355c8bb38a80c98c68485757044e4ea051f61

SHA256
8a4a65cbe02c8d11d33d9a17c8a96acb6dd64fcb319aa472ad76b11ef9088afa

SHA512
ab0569537650893c4422ae5de2ff5f270aea68b55bb019917a4d451f00c2e78d4134e85c1097ad7683fa227aa19ffba906392bb8db333ff180f0983d10ad754b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads