cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc

Analysis

max time kernel
158s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Size

586KB
MD5

0429c08b4bcb5a774c51db778634e6e0
SHA1

9ba3eb512b19dbaec8cda49815f7546d2903d400
SHA256

cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc
SHA512

1be846da18626e9fc45909a19840cf9c72cafd458239e40c48c97b34e12d8e168f060524572b6630de21f8812a7a9155850820375ba69981e0e6da823130051a
SSDEEP

12288:xlx79RzocbdKnKjyx7j4aMVkUet7EwBI+APuUpWDxZ:xb9Jnd2bx7MzVkUetVI5uAWtZ

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alumni_Smoensa_Pangkalpinang = "Mr_CoolFace"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\My_Old_Class = "3IPA2.SMANSA.PKP.exe"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityService = "C:\\Windows\\services.exe"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ftu = "axf.exe"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Drops desktop.ini file(s) 46 IoCs

description	ioc	Process
File created	\??\j:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\p:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\v:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\m:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\p:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\q:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\s:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\t:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\y:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\h:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\i:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\m:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\q:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\r:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\v:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\x:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\z:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\c:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\e:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\k:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\t:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\u:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\w:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\w:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\x:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\k:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\o:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\u:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\c:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\f:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\g:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\i:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\l:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\l:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\n:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\n:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\r:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\s:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\y:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\z:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\f:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\g:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\e:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\h:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\j:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\o:\Desktop.ini	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\s:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\f:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\n:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\u:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\v:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\w:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\y:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\h:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\o:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\l:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\q:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\x:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\e:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\g:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\k:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\m:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\r:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\t:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\z:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\i:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened (read-only)	\??\j:	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Drops autorun.inf file 1 TTPs 46 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\k:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\m:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\q:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\t:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\w:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\g:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\n:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\o:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\p:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\r:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\r:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\y:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\k:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\f:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\t:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\u:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\z:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\f:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\l:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\l:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\x:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\c:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\e:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\h:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\o:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\q:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\v:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\c:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\i:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\j:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\m:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\s:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\u:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\w:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\x:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\e:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\h:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\i:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\j:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\n:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\p:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\v:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\y:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\g:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	\??\z:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	\??\s:\Autorun.inf	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\3IPA2.SMANSA.PKP.exe	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	C:\Windows\SysWOW64\3IPA2.SMANSA.PKP.exe	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	C:\Windows\SysWOW64\axf.exe	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File opened for modification	C:\Windows\SysWOW64\axf.exe	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Emira.Emma	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	C:\Program Files\Common Files\Aliciana.Alisa	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	C:\Program Files\Irma Triana.scr	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	C:\Program Files\I_Miss_U_MyPrincess.scr	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	C:\Program Files\Your_Prince_Will_Be_Waiting_For_You.scr	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	C:\Program Files\May be Smansa was wonderful place to us.scr	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Negeri Serumpun Sebalai .pif .bat .com .scr .exe	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
File created	C:\Windows\services.exe	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4284	4968	WerFault.exe	79

Modifies Control Panel 7 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\sCountry = "BANGKA_ISLAND"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\sCurrency = "Pepper_n_Tin"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s1159 = "Renova"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\s2359 = "Renova"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4968	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
4968	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe

C:\Users\Admin\AppData\Local\Temp\cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe
"C:\Users\Admin\AppData\Local\Temp\cba2fa2ff417e972dcbf783b90d368cf45ef301c3a4b8348a54a77d6977551cc.exe"
1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:4968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 864
  2⤵
  - Program crash
  PID:4284