Analysis
-
max time kernel
166s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 05:35
Static task
static1
Behavioral task
behavioral1
Sample
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe
Resource
win10v2004-20221111-en
General
-
Target
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe
-
Size
510KB
-
MD5
6f502f1cc527cbc62411532220e1ce86
-
SHA1
58c1b175ef0f758bcf26dd6d36a5597d0289fd10
-
SHA256
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524
-
SHA512
cccf8a62f96bd36fb9ed7b1f3f4b7d73b6dd2ffe1f1c9a6495830cc1f067c39afa603edad0a7cd6034ba6a1d344ff233b86950bdd02c1a258cf05f6fa688d1f1
-
SSDEEP
12288:xCTPgrnZiJiAaMVkUet7EwBI+APu2DrVkP+xnXOBI+AM0bUjr:xCTPMAzVkUetVI5u2/VkP+x6IS0b+r
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Disables use of System Restore points 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zedneh = "xvsswd.exe" 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Drops desktop.ini file(s) 48 IoCs
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exedescription ioc process File opened for modification \??\u:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\i:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\j:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\o:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\z:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\g:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\j:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\q:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\r:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\w:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\x:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\e:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\h:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\v:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\f:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\f:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\p:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\y:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\u:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\y:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\c:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\k:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\l:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\q:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\z:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\c:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\l:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\s:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\x:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\s:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\v:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\i:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\m:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\n:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\p:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\m:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\n:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\o:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\r:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\e:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\g:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\h:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\k:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\t:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\t:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\w:\Desktop.ini 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exedescription ioc process File opened (read-only) \??\v: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\y: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\s: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\g: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\l: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\n: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\p: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\q: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\t: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\x: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\j: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\f: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\h: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\i: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\k: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\m: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\o: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\r: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\e: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\w: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\z: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened (read-only) \??\u: 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Drops autorun.inf file 1 TTPs 47 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exedescription ioc process File opened for modification \??\c:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\k:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\p:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\r:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\t:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\w:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\y:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\c:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\f:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\m:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\p:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\q:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\g:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\k:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\t:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\u:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\v:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\h:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\m:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\u:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\x:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\x:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\z:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created C:\Documents and Settings\Admin\Application Data\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\i:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\j:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\o:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\z:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\r:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\s:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\s:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\e:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\e:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\h:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\i:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\l:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\y:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\j:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\n:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\q:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\v:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\w:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\f:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\g:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification \??\l:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\n:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created \??\o:\Autorun.inf 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Drops file in System32 directory 3 IoCs
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exedescription ioc process File created C:\Windows\SysWOW64\msvbvm60.dll 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File created C:\Windows\SysWOW64\xvsswd.exe 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe File opened for modification C:\Windows\SysWOW64\xvsswd.exe 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Drops file in Windows directory 1 IoCs
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exedescription ioc process File created C:\Windows\Negeri Serumpun Sebalai .pif .bat .com .scr .exe 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4188 1768 WerFault.exe 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Modifies Control Panel 3 IoCs
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR" 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe Set value (str) \REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60" 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Modifies registry class 3 IoCs
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image" 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document" 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exepid process 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe 1768 2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe"C:\Users\Admin\AppData\Local\Temp\2f283fb253cc63f74a71f71367084dbb35015193fecfc112725ea5529b434524.exe"1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 9322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1768 -ip 17681⤵