ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f

Analysis

max time kernel
90s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Size

533KB
MD5

3e2feb71f64528d9b1fc89e659ecbceb
SHA1

8bc722ca6e8723915025bb3b3363e7bc26c3a120
SHA256

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f
SHA512

e28290e9d8b2795d1fa8195e3f4a9bee70cf278f30ae8197d2fd33fa631fe40878705f4f5e9df1dd17138d509ac24ed546c503fc54d253ffe8c51a345c9fcc1d
SSDEEP

12288:xCTPgrnZiJiAaMVkUet7EwBI+APu4UjQLDW:xCTPMAzVkUetVI5u4+SDW

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

qljgz.exeab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe, C:\\explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\explorer.exe\""	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe, C:\\explorer.exe"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe \"C:\\explorer.exe\""	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exeqljgz.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	qljgz.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exeqljgz.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	qljgz.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

inf4D2.tmpqljgz.exe

pid process

5052 inf4D2.tmp
4388 qljgz.exe

pid	process
5052	inf4D2.tmp
4388	qljgz.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

qljgz.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Program Files\\Common Files\\tskmgr.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshearts.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe\Debugger = "C:\\Program Files\\Common Files\\kalkulator.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spider.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmine.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mplayer2.exe\Debugger = "C:\\Program Files\\Common Files\\kalkulator.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe\Debugger = "C:\\Program Files\\Common Files\\kartu.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCMAV.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANSAV32.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winmine.exe\Debugger = "C:\\Program Files\\Common Files\\w1nm1ne.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANSAV.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sol.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Njeeves.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freecell.exe\Debugger = "C:\\Program Files\\Common Files\\freecel.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Program Files\\Common Files\\reged1t.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zanda.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CClaw.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\URemovalCRC32.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcod.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winamp.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANSAV32.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\URemovalCRC32.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANSAV.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshearts.exe\Debugger = "C:\\Program Files\\Common Files\\msheart.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\freecell.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Zlh.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "C:\\Program Files\\Common Files\\N0TEPAD.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mplayer2.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcsched.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcsched.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winamp.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcod.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvccf.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sol.exe\Debugger = "C:\\Program Files\\Common Files\\kartu.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Niu.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spider.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nip.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nipsvc.exe	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Nvcoas.exe\Debugger = "C:\\Explorer.exe"	qljgz.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exeqljgz.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\bkadm = "mekpu.exe"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qljgz.exe = "C:\\Documents and Settings\\Admin\\Local Settings\\qljgz.exe"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alumni_Smoensa_Pangkalpinang = "Mr_CoolFace"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\My_Old_Class = "3IPA2.pif"	qljgz.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exeqljgz.exe

description	ioc	process
File created	\??\p:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\q:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\w:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\x:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\q:\Desktop.ini	qljgz.exe
File opened for modification	\??\t:\Desktop.ini	qljgz.exe
File opened for modification	\??\c:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\f:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\j:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\r:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\z:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\h:\Desktop.ini	qljgz.exe
File created	\??\o:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\n:\Desktop.ini	qljgz.exe
File opened for modification	\??\z:\Desktop.ini	qljgz.exe
File opened for modification	\??\l:\Desktop.ini	qljgz.exe
File opened for modification	\??\o:\Desktop.ini	qljgz.exe
File opened for modification	\??\k:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\q:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\r:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\z:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\e:\Desktop.ini	qljgz.exe
File opened for modification	\??\j:\Desktop.ini	qljgz.exe
File created	\??\s:\Desktop.ini	qljgz.exe
File created	\??\w:\Desktop.ini	qljgz.exe
File opened for modification	\??\s:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\e:\Desktop.ini	qljgz.exe
File created	\??\c:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\e:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\e:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\g:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\i:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\m:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\u:\Desktop.ini	qljgz.exe
File opened for modification	\??\y:\Desktop.ini	qljgz.exe
File opened for modification	\??\g:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\l:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\i:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\n:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\f:\Desktop.ini	qljgz.exe
File created	\??\k:\Desktop.ini	qljgz.exe
File created	\??\t:\Desktop.ini	qljgz.exe
File created	\??\v:\Desktop.ini	qljgz.exe
File created	\??\k:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\g:\Desktop.ini	qljgz.exe
File opened for modification	\??\s:\Desktop.ini	qljgz.exe
File created	\??\z:\Desktop.ini	qljgz.exe
File created	\??\y:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\v:\Desktop.ini	qljgz.exe
File opened for modification	\??\h:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\j:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\m:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\s:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\u:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\v:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\x:\Desktop.ini	qljgz.exe
File created	\??\p:\Desktop.ini	qljgz.exe
File created	\??\r:\Desktop.ini	qljgz.exe
File created	\??\h:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\p:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\u:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\y:\Desktop.ini	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\i:\Desktop.ini	qljgz.exe
File opened for modification	\??\k:\Desktop.ini	qljgz.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exeqljgz.exe

description	ioc	process
File opened (read-only)	\??\h:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\q:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\t:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\x:	qljgz.exe
File opened (read-only)	\??\y:	qljgz.exe
File opened (read-only)	\??\k:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\i:	qljgz.exe
File opened (read-only)	\??\q:	qljgz.exe
File opened (read-only)	\??\r:	qljgz.exe
File opened (read-only)	\??\e:	qljgz.exe
File opened (read-only)	\??\t:	qljgz.exe
File opened (read-only)	\??\e:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\f:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\n:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\o:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\r:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\z:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\s:	qljgz.exe
File opened (read-only)	\??\u:	qljgz.exe
File opened (read-only)	\??\o:	qljgz.exe
File opened (read-only)	\??\z:	qljgz.exe
File opened (read-only)	\??\j:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\l:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\m:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\v:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\h:	qljgz.exe
File opened (read-only)	\??\n:	qljgz.exe
File opened (read-only)	\??\w:	qljgz.exe
File opened (read-only)	\??\u:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\w:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\g:	qljgz.exe
File opened (read-only)	\??\j:	qljgz.exe
File opened (read-only)	\??\k:	qljgz.exe
File opened (read-only)	\??\m:	qljgz.exe
File opened (read-only)	\??\p:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\s:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\x:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\y:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\g:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\i:	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened (read-only)	\??\f:	qljgz.exe
File opened (read-only)	\??\l:	qljgz.exe
File opened (read-only)	\??\p:	qljgz.exe
File opened (read-only)	\??\v:	qljgz.exe

Drops autorun.inf file 1 TTPs 64 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exeqljgz.exe

description	ioc	process
File opened for modification	\??\x:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\z:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\p:\Autorun.inf	qljgz.exe
File opened for modification	\??\g:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\j:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\p:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\q:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\t:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	C:\Documents and Settings\Admin\Application Data\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\i:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\j:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\n:\Autorun.inf	qljgz.exe
File opened for modification	\??\r:\Autorun.inf	qljgz.exe
File created	\??\x:\Autorun.inf	qljgz.exe
File created	\??\y:\Autorun.inf	qljgz.exe
File opened for modification	\??\z:\Autorun.inf	qljgz.exe
File created	\??\f:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\o:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\s:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	C:\Documents and Settings\Admin\Application Data\Autorun.inf	qljgz.exe
File created	\??\h:\Autorun.inf	qljgz.exe
File created	\??\m:\Autorun.inf	qljgz.exe
File created	\??\n:\Autorun.inf	qljgz.exe
File created	\??\s:\Autorun.inf	qljgz.exe
File created	\??\i:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\n:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\w:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\v:\Autorun.inf	qljgz.exe
File opened for modification	\??\j:\Autorun.inf	qljgz.exe
File opened for modification	\??\u:\Autorun.inf	qljgz.exe
File created	\??\m:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\e:\Autorun.inf	qljgz.exe
File opened for modification	\??\e:\Autorun.inf	qljgz.exe
File created	\??\l:\Autorun.inf	qljgz.exe
File opened for modification	\??\o:\Autorun.inf	qljgz.exe
File opened for modification	\??\s:\Autorun.inf	qljgz.exe
File opened for modification	\??\e:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\s:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\h:\Autorun.inf	qljgz.exe
File created	\??\k:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\z:\Autorun.inf	qljgz.exe
File opened for modification	\??\w:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\t:\Autorun.inf	qljgz.exe
File created	\??\w:\Autorun.inf	qljgz.exe
File opened for modification	\??\y:\Autorun.inf	qljgz.exe
File created	\??\h:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\m:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\t:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\i:\Autorun.inf	qljgz.exe
File created	\??\j:\Autorun.inf	qljgz.exe
File created	\??\v:\Autorun.inf	qljgz.exe
File opened for modification	\??\l:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\r:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\g:\Autorun.inf	qljgz.exe
File opened for modification	\??\k:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\u:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\u:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\v:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\z:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\c:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\f:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	\??\g:\Autorun.inf	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	\??\x:\Autorun.inf	qljgz.exe
File opened for modification	\??\k:\Autorun.inf	qljgz.exe

Drops file in System32 directory 7 IoCs

Processes:

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exeqljgz.exe

description	ioc	process
File created	C:\Windows\SysWOW64\mekpu.exe	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	C:\Windows\SysWOW64\mekpu.exe	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	C:\Windows\SysWOW64\Mr_CoolFace.scr	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	C:\Windows\SysWOW64\Mr_CoolFace.scr	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	qljgz.exe
File created	C:\Windows\SysWOW64\3IPA2.pif	qljgz.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe

Drops file in Program Files directory 6 IoCs

Processes:

qljgz.exe

description	ioc	process
File created	C:\Program Files\Common Files\Mutation.bat	qljgz.exe
File created	C:\Program Files\Common Files\_cmd.exe	qljgz.exe
File created	C:\Program Files\Common Files\N0TEPAD.exe	qljgz.exe
File created	C:\Program Files\Common Files\kalkulator.exe	qljgz.exe
File created	C:\Program Files\Common Files\tskmgr.exe	qljgz.exe
File created	C:\Program Files\Common Files\reged1t.exe	qljgz.exe

Drops file in Windows directory 7 IoCs

Processes:

inf4D2.tmpab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe

description	ioc	process
File created	C:\Windows\pss\system.ini.backup	inf4D2.tmp
File opened for modification	C:\Windows\pss\win.ini.backup	inf4D2.tmp
File created	C:\Windows\pss\win.ini.backup	inf4D2.tmp
File opened for modification	C:\Windows\system.ini	inf4D2.tmp
File opened for modification	C:\Windows\win.ini	inf4D2.tmp
File created	C:\Windows\Negeri Serumpun Sebalai .pif .bat .com .scr .exe	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
File opened for modification	C:\Windows\pss\system.ini.backup	inf4D2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3384 4388 WerFault.exe qljgz.exe

pid	pid_target	process	target process
3384	4388	WerFault.exe	qljgz.exe

Modifies Control Panel 6 IoCs

evasion

Processes:

qljgz.exeab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR"	qljgz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	qljgz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	qljgz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

Processes:

qljgz.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "C:\\Mutant.htm"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "C:\\Mutant.htm"	qljgz.exe

Modifies registry class 6 IoCs

Processes:

qljgz.exeab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document"	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	qljgz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image"	qljgz.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exeqljgz.exe

pid	process
3564	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
3564	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
3564	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
3564	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe
4388	qljgz.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

inf4D2.tmp

description pid process

Token: SeShutdownPrivilege 5052 inf4D2.tmp
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

inf4D2.tmp

pid process

5052 inf4D2.tmp
5052 inf4D2.tmp

description	pid	process
Token: SeShutdownPrivilege	5052	inf4D2.tmp

pid	process
5052	inf4D2.tmp
5052	inf4D2.tmp

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe

description	pid	process	target process
PID 3564 wrote to memory of 5052	3564	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe	inf4D2.tmp
PID 3564 wrote to memory of 5052	3564	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe	inf4D2.tmp
PID 3564 wrote to memory of 5052	3564	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe	inf4D2.tmp
PID 3564 wrote to memory of 4388	3564	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe	qljgz.exe
PID 3564 wrote to memory of 4388	3564	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe	qljgz.exe
PID 3564 wrote to memory of 4388	3564	ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe	qljgz.exe

C:\Users\Admin\AppData\Local\Temp\ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe
"C:\Users\Admin\AppData\Local\Temp\ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Checks computer location settings
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3564

C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5052

C:\Documents and Settings\Admin\Local Settings\qljgz.exe
"C:\Documents and Settings\Admin\Local Settings\qljgz.exe"
2⤵
- Modifies WinLogon for persistence
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Control Panel
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 1540
3⤵
- Program crash
PID:3384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4388 -ip 4388
1⤵
PID:1456

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Documents and Settings\Admin\Application Data\Autorun.inf
Filesize
97B

MD5
e0b7531a87635a0a11dbd9edc02c7bed

SHA1
74a50849add50351da332164cbf0ae74a43ce8fe

SHA256
20e16cf8b48b2bf3adc59251e7dc293c39eb87922d267a768a403fb76f13d765

SHA512
e6cbf6e11ad29d17c219ca44ebbcb43adb76bef3d688f38e43520faded492caff162e249bd477f5441858a26eb567c3f70be3cf3cc181a2fb62aaae4efd23c67

Download Submit
C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini
Filesize
212B

MD5
ca815edf2e481dd83bd0cff16caaf7a7

SHA1
523fa767fac1b4061762c0262d4bc09a1fa7dddf

SHA256
f2566afa47cadf4017f82ee80f11355989fd722fbbbbed1954392bbe2aa2b352

SHA512
cef1cf04432326393cd700b6c9c4d3d816a61505a3ba99bafc935ffd52a78635130a752d091dd6511d9781ac9458a404bcfc69ca0cdec55da418b3b8bf9dace2

Download Submit
C:\Documents and Settings\Admin\Application Data\Mr_CF\Folder.htt
Filesize
631B

MD5
5313060d847a33c356e4e8e286e3de73

SHA1
d2b5e89f1fbb96895371e1cde7997ff76814ea9e

SHA256
ee482ee2540efc03f1cba611170096f68e14fd4d39bdc8650f3ef6900799fafc

SHA512
8c90a8fd5372dadfe95df1deb07bbd14355620dd067b2cce58f76230e2f99129daf65ddc056cab0902ab2b70a4b838a484f62f37b0436e21a963dd1156f551b0

Download Submit
C:\Documents and Settings\Admin\Application Data\Mr_CoolFace.exe
Filesize
10B

MD5
aa890e8b6cea14efee15351d0b023647

SHA1
ab262afffd2fc9205c51a3d033f88261d9e5f51d

SHA256
e432cd74ed24c9414e067f2df39ecd17837ef30efd1302f7ea0549a5e26b9277

SHA512
cb3b61c01a5fd2f904674bf66c8324f4b846c2f5005342edd8acf3c3049935392a11bf79c7cf87c47de1ceb6f6eef47020ec82a7542098ed265247f9fde320db

Download Submit
C:\Documents and Settings\Admin\Application Data\Mutant.exe
Filesize
5B

MD5
d32148ccda3f7a55f0b7f076a816256f

SHA1
c03f44c9e7d0169012d356ee866d03e6c2832588

SHA256
92e78809a183258b69eb841f6faf7f2ab6e404bc34a6200cc9e17460c33da56f

SHA512
742d909eed5aaf0b7f246d7f4a139c14fff7ca1b93d1fe8e6814b1023a8a3b30e7c852ee7865a8803f9f4a80709d4e56d7c51b4df3e12f0dc87bd190b9ce68ab

Download Submit
C:\Documents and Settings\Admin\Application Data\SMA Negeri 1 Pangkalpinang.exe
Filesize
5B

MD5
e3afed0047b08059d0fada10f400c1e5

SHA1
4e7afebcfbae000b22c7c85e5560f89a2a0280b4

SHA256
c1c224b03cd9bc7b6a86d77f5dace40191766c485cd55dc48caf9ac873335d6f

SHA512
887375daec62a9f02d32a63c9e14c7641a9a8a42e4fa8f6590eb928d9744b57bb5057a1d227e4d40ef911ac030590bbce2bfdb78103ff0b79094cee8425601f5

Download Submit
C:\Documents and Settings\Admin\Application Data\Sahang.exe
Filesize
5B

MD5
7e261f3daad0c1e3f69595637b44c7bb

SHA1
e66f4989a31d9bc21323bed5769f1d825e5019b9

SHA256
aa63de038d1dd4154ee9a65597d7dee0c1326dc285f9404ec7736781e27c0597

SHA512
b20e2c87566b2bfeff37385b6a7a155d9ee3df642dc5d1f73bb7c944067a06e2064c1693268269a5d26ff7caa1f924a47e2f2543a0947f9fe74e16f176f82f2b

Download Submit
C:\Documents and Settings\Admin\Application Data\Timah.exe
Filesize
5B

MD5
0c5045709c31be521d0c61c10d438b64

SHA1
eda07128253fa4eddf17745f26ecee6157ce1ee0

SHA256
5952a84b0c9e9814f2746ec1f74274b5fae6eacdd1ad2a47f4e9b79542030380

SHA512
7fdecf48f3c153ca40b1370101955dc1905dbc8054d5993638d97711089da2f788415ba616fbf9e0fece3e7df40d897b723d90c7e32be744dc4511bd2bf80e0d

Download Submit
C:\Documents and Settings\Admin\Application Data\explorer.exe
Filesize
5B

MD5
ab4444306af67246c6bf4665861a7033

SHA1
dc1ea19b142476b7c26f76d697044511cc80f955

SHA256
3e2acfa11dd607c12bda890812e2d76330d1cf73755afdad7b38d7c883d74946

SHA512
1e05b8da2edd1cff518382ce9c07373c7d69371ed413af7648c68d50fd08e477525525d7d7f2c0d851daddafe2b5ecbd08e0f30c9912962e9236fc3b10130214

Download Submit
C:\Documents and Settings\Admin\Desktop\Message For My Princess.txt
Filesize
533KB

MD5
3e2feb71f64528d9b1fc89e659ecbceb

SHA1
8bc722ca6e8723915025bb3b3363e7bc26c3a120

SHA256
ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f

SHA512
e28290e9d8b2795d1fa8195e3f4a9bee70cf278f30ae8197d2fd33fa631fe40878705f4f5e9df1dd17138d509ac24ed546c503fc54d253ffe8c51a345c9fcc1d

Download Submit
C:\Documents and Settings\Admin\Local Settings\Application Data\Polymorph1.exe
Filesize
10B

MD5
be6aa9304c718cc0662066dc607cac7e

SHA1
ced81fdddad9945854d7f9ddc314960d62aa4cc7

SHA256
2fc343366abb2fbef9eefb840bd62e74da471dc22e6ea54c845850c37d406d03

SHA512
a64474d0f6155bb7dab6d3bb1e504cdfea9231c86e1be561ba603954fc83df78e0d30475355e55d234d4b700a6b1d34ed5b0523f21f28790a65b4584e8891edb

Download Submit
C:\Documents and Settings\Admin\Local Settings\Application Data\Polymorph2.exe
Filesize
12B

MD5
79a42f3c2c1d4ee83fb3b272d95f91b4

SHA1
c264781161c7099449c97c83e070383dee302fc5

SHA256
e40701fa689b17d516009beb9902e73366da021a323c5ea494fbce06f1708617

SHA512
d065f40115991b3b561aa9e7205e79d7ee134f56cc5a5c4a1ff7679fa06494d20414ead21e21ccd3f8291c44197f302e00f26ee61844bc062691e4c0c4467e04

Download Submit
C:\Documents and Settings\Admin\Local Settings\qljgz.exe
Filesize
533KB

MD5
3e2feb71f64528d9b1fc89e659ecbceb

SHA1
8bc722ca6e8723915025bb3b3363e7bc26c3a120

SHA256
ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f

SHA512
e28290e9d8b2795d1fa8195e3f4a9bee70cf278f30ae8197d2fd33fa631fe40878705f4f5e9df1dd17138d509ac24ed546c503fc54d253ffe8c51a345c9fcc1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
Filesize
166KB

MD5
a81135541c9d4ebce43efa8ad31395b4

SHA1
c4e6cba41ebea2ead0278bcd80991f4e9c6c6a74

SHA256
96cf8e21b7838d8162c68825bc8c4747a4380acb672ff73423cbea3ef5590e4b

SHA512
b9dffc68a0c11535698345e1bbd58c82dc2a7a142aadd3d21c4f535eb191887340b30f93df1f484d2624b0d3aee4d0e9d52827b4a28c6e904c24d9e07115f768

Download Submit
C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
Filesize
166KB

MD5
a81135541c9d4ebce43efa8ad31395b4

SHA1
c4e6cba41ebea2ead0278bcd80991f4e9c6c6a74

SHA256
96cf8e21b7838d8162c68825bc8c4747a4380acb672ff73423cbea3ef5590e4b

SHA512
b9dffc68a0c11535698345e1bbd58c82dc2a7a142aadd3d21c4f535eb191887340b30f93df1f484d2624b0d3aee4d0e9d52827b4a28c6e904c24d9e07115f768

Download Submit
C:\Users\Admin\AppData\Local\qljgz.exe
Filesize
533KB

MD5
3e2feb71f64528d9b1fc89e659ecbceb

SHA1
8bc722ca6e8723915025bb3b3363e7bc26c3a120

SHA256
ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f

SHA512
e28290e9d8b2795d1fa8195e3f4a9bee70cf278f30ae8197d2fd33fa631fe40878705f4f5e9df1dd17138d509ac24ed546c503fc54d253ffe8c51a345c9fcc1d

Download Submit
C:\explorer.exe
Filesize
5B

MD5
d32148ccda3f7a55f0b7f076a816256f

SHA1
c03f44c9e7d0169012d356ee866d03e6c2832588

SHA256
92e78809a183258b69eb841f6faf7f2ab6e404bc34a6200cc9e17460c33da56f

SHA512
742d909eed5aaf0b7f246d7f4a139c14fff7ca1b93d1fe8e6814b1023a8a3b30e7c852ee7865a8803f9f4a80709d4e56d7c51b4df3e12f0dc87bd190b9ce68ab

Download Submit
\??\c:\Autorun.inf
Filesize
97B

MD5
e0b7531a87635a0a11dbd9edc02c7bed

SHA1
74a50849add50351da332164cbf0ae74a43ce8fe

SHA256
20e16cf8b48b2bf3adc59251e7dc293c39eb87922d267a768a403fb76f13d765

SHA512
e6cbf6e11ad29d17c219ca44ebbcb43adb76bef3d688f38e43520faded492caff162e249bd477f5441858a26eb567c3f70be3cf3cc181a2fb62aaae4efd23c67

Download Submit
\??\c:\Desktop.ini
Filesize
212B

MD5
ca815edf2e481dd83bd0cff16caaf7a7

SHA1
523fa767fac1b4061762c0262d4bc09a1fa7dddf

SHA256
f2566afa47cadf4017f82ee80f11355989fd722fbbbbed1954392bbe2aa2b352

SHA512
cef1cf04432326393cd700b6c9c4d3d816a61505a3ba99bafc935ffd52a78635130a752d091dd6511d9781ac9458a404bcfc69ca0cdec55da418b3b8bf9dace2

Download Submit
\??\c:\Folder.htt
Filesize
631B

MD5
5313060d847a33c356e4e8e286e3de73

SHA1
d2b5e89f1fbb96895371e1cde7997ff76814ea9e

SHA256
ee482ee2540efc03f1cba611170096f68e14fd4d39bdc8650f3ef6900799fafc

SHA512
8c90a8fd5372dadfe95df1deb07bbd14355620dd067b2cce58f76230e2f99129daf65ddc056cab0902ab2b70a4b838a484f62f37b0436e21a963dd1156f551b0

Download Submit
\??\c:\Mr_CF.pif
Filesize
533KB

MD5
3e2feb71f64528d9b1fc89e659ecbceb

SHA1
8bc722ca6e8723915025bb3b3363e7bc26c3a120

SHA256
ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f

SHA512
e28290e9d8b2795d1fa8195e3f4a9bee70cf278f30ae8197d2fd33fa631fe40878705f4f5e9df1dd17138d509ac24ed546c503fc54d253ffe8c51a345c9fcc1d

Download Submit
\??\c:\Mr_CoolFace.scr
Filesize
533KB

MD5
3e2feb71f64528d9b1fc89e659ecbceb

SHA1
8bc722ca6e8723915025bb3b3363e7bc26c3a120

SHA256
ab6c6ae71ac2ad8c6705aa842bbb689ef2cd69208294536f33fe671ed7ed390f

SHA512
e28290e9d8b2795d1fa8195e3f4a9bee70cf278f30ae8197d2fd33fa631fe40878705f4f5e9df1dd17138d509ac24ed546c503fc54d253ffe8c51a345c9fcc1d

Download Submit
memory/4388-135-0x0000000000000000-mapping.dmp

Download
memory/5052-132-0x0000000000000000-mapping.dmp

Download