Analysis
-
max time kernel
136s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 23:22
Static task
static1
Behavioral task
behavioral1
Sample
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe
Resource
win10v2004-20220812-en
General
-
Target
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe
-
Size
1.5MB
-
MD5
f599e7244d548ecafafdea2819e1ba57
-
SHA1
39c9fd2fef29eccdf98ee2af7acdc47506f3d9e0
-
SHA256
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673
-
SHA512
a934587f3f3c32348e71635dc069b4f8892de7d00538f20e4fd585cbf7c64efc6edc3092700d663a785d637a5b6a8ae56170531698844d35b754ced5f04235b3
-
SSDEEP
24576:xCTPMAzVkUetVI5ut/VkP+x6IS02FmZu4Pw:UPMmZuvS02FmZul
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Disables use of System Restore points 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zgvln = "vkrio.exe" 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Drops desktop.ini file(s) 48 IoCs
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exedescription ioc process File opened for modification \??\v:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\v:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\y:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\z:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\f:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\r:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\m:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\p:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\q:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\s:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\g:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\j:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\u:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\u:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\j:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\m:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\n:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\x:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\y:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\z:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\c:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\h:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\q:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\x:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\k:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\l:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\e:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\i:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\r:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\s:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\t:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\w:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\g:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\k:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\l:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\n:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\o:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\o:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\e:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\f:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\t:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\w:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\i:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\p:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\c:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\h:\Desktop.ini 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exedescription ioc process File opened (read-only) \??\t: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\y: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\z: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\k: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\q: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\m: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\n: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\p: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\s: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\u: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\v: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\g: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\h: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\w: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\l: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\o: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\e: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\i: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\r: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\x: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\f: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened (read-only) \??\j: 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Drops autorun.inf file 1 TTPs 47 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exedescription ioc process File created \??\o:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\y:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\e:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\f:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\i:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\n:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\v:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\z:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\c:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\g:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\l:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\p:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\t:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\y:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\n:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\o:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\p:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\q:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\c:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\e:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\i:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\m:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\x:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\q:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\s:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\u:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\v:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\r:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\w:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created C:\Documents and Settings\Admin\Application Data\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\j:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\k:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\r:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\w:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\f:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\j:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\m:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\u:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\x:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\z:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\h:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\h:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\k:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\t:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\g:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created \??\l:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification \??\s:\Autorun.inf 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Drops file in System32 directory 3 IoCs
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exedescription ioc process File created C:\Windows\SysWOW64\msvbvm60.dll 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File created C:\Windows\SysWOW64\vkrio.exe 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe File opened for modification C:\Windows\SysWOW64\vkrio.exe 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Drops file in Windows directory 1 IoCs
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exedescription ioc process File created C:\Windows\Negeri Serumpun Sebalai .pif .bat .com .scr .exe 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4992 3044 WerFault.exe 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Modifies Control Panel 3 IoCs
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR" 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60" 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Modifies registry class 3 IoCs
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document" 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image" 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exepid process 3044 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe 3044 86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe"C:\Users\Admin\AppData\Local\Temp\86518918c856e97fb1d39e281378202e7292cf58fd8d806f3c70356ba1804673.exe"1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3044 -s 8642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3044 -ip 30441⤵