52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336

General

Target

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
Size

901KB
MD5

025b64dd751bd9278d8005b18076bec8
SHA1

9526be88916f8713d5eb0699652b1ae49ebaf03a
SHA256

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336
SHA512

42385631fa7fe25b25eae89dfdb012d249dda820c8bc0807d68b2a18c2fdba0f938c9c44854ac21a0539822f091ae4dcd443aa13dcbff5b0b0fc71451732ceba
SSDEEP

12288:xeXr/Cm+XQ9i8aMVkUet7EwBI+APuALDbFmZcZlyNGUO:xGr/Cm+X18zVkUetVI5uiDbFmZu4PO

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Executes dropped EXE 1 IoCs

Processes:

inf4D2.tmp

pid process

2172 inf4D2.tmp

pid	process
2172	inf4D2.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lmmdp = "wetww.exe"	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Drops desktop.ini file(s) 48 IoCs

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	ioc	process
File opened for modification	\??\j:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\l:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\r:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\w:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\o:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\t:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\u:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\h:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\i:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\l:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\n:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\w:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\x:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\y:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\h:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\m:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\o:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\v:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\y:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\k:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\u:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\v:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\g:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\n:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\r:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\s:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\s:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\f:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\g:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\i:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\m:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\p:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\q:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\x:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\z:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\f:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\j:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\k:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\c:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\c:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\e:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\e:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\p:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\q:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\t:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\z:\Desktop.ini	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	ioc	process
File opened (read-only)	\??\i:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\m:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\q:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\s:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\u:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\x:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\z:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\j:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\n:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\o:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\v:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\y:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\e:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\l:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\t:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\w:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\f:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\g:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\h:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\k:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\p:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened (read-only)	\??\r:	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Drops autorun.inf file 1 TTPs 47 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	ioc	process
File created	\??\c:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\f:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\h:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\i:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\n:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\r:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\u:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\y:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\y:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\c:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\f:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\o:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\v:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\e:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\h:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\m:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\p:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\s:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\t:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\v:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\w:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\z:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	C:\Documents and Settings\Admin\Application Data\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\m:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\s:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\g:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\g:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\k:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\n:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\q:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\r:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\l:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\w:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\z:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\e:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\j:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\k:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\q:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\u:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\x:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\x:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\i:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\j:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\l:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\o:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	\??\p:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	\??\t:\Autorun.inf	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Drops file in System32 directory 3 IoCs

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	ioc	process
File created	C:\Windows\SysWOW64\msvbvm60.dll	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File created	C:\Windows\SysWOW64\wetww.exe	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
File opened for modification	C:\Windows\SysWOW64\wetww.exe	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Drops file in Windows directory 1 IoCs

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	ioc	process
File created	C:\Windows\Negeri Serumpun Sebalai .pif .bat .com .scr .exe	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4808 4716 WerFault.exe 52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

pid	pid_target	process	target process
4808	4716	WerFault.exe	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Modifies Control Panel 3 IoCs

evasion

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR"	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Modifies registry class 3 IoCs

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image"	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document"	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

pid	process
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

pid process

4716 52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe

description	pid	process	target process
PID 4716 wrote to memory of 2172	4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe	inf4D2.tmp
PID 4716 wrote to memory of 2172	4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe	inf4D2.tmp
PID 4716 wrote to memory of 2172	4716	52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe	inf4D2.tmp

C:\Users\Admin\AppData\Local\Temp\52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe
"C:\Users\Admin\AppData\Local\Temp\52cc8b9da33ddd5746e47ccee7beb62bf48fbadbc10efb436ec82eee4db60336.exe"
1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4716

C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
2⤵
- Executes dropped EXE
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 916
2⤵
- Program crash
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4716 -ip 4716
1⤵
PID:4584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Change Default File Association

1

T1042

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp

Filesize
380KB

MD5
6d778e0f95447e6546553eeea709d03c

SHA1
811a005cf787c6ccbe0d9f1c36c1d49a9cb71fd1

SHA256
62abed7d45040381bbced97ea7b6c697b418448fd3322fd4bfb2bbfdb6155eb4

SHA512
a9401d8b077a48c0b6dd3443e62703d53513208f49d7b44d14f722f4c5400ffaca59582ca066d92d68a72aa96278bed1b2c5d8f1b85d5ef964d06e979a9ac09f

Download Submit
C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp

Filesize
380KB

MD5
6d778e0f95447e6546553eeea709d03c

SHA1
811a005cf787c6ccbe0d9f1c36c1d49a9cb71fd1

SHA256
62abed7d45040381bbced97ea7b6c697b418448fd3322fd4bfb2bbfdb6155eb4

SHA512
a9401d8b077a48c0b6dd3443e62703d53513208f49d7b44d14f722f4c5400ffaca59582ca066d92d68a72aa96278bed1b2c5d8f1b85d5ef964d06e979a9ac09f

Download Submit
memory/2172-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads