Analysis
-
max time kernel
151s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 01:48
Static task
static1
Behavioral task
behavioral1
Sample
5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe
Resource
win7-20221111-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe
-
Size
377KB
-
MD5
8ecfa798046c77b9d76a94b14b02b02c
-
SHA1
b1926a868f929e6673a5c947772a4e95a08f5a56
-
SHA256
5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8
-
SHA512
3545eef3a5437cdd47adbfdcce2d12750296a5d42b1d85c6de674016e89fe009eab5274d701f21d23f720be5a604becf7bf2d755cebe75a8ca4d7073fe7a6051
-
SSDEEP
6144:xCTPgrnq0/FniJi6uTJKvePPMqLckUet72FwBI+AFdb8Mu2tkqxrqLckP+xn0YOz:xCTPgrnZiJiAaMVkUet7EwBI+APu2DrY
Score
10/10
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Disables use of System Restore points 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ulsju = "uepnq.exe" 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Drops desktop.ini file(s) 48 IoCs
description ioc Process File created \??\q:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\x:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\c:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\g:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\h:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\i:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\p:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\f:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\p:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\r:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\x:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\w:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\w:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\e:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\m:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\n:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\o:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\s:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\l:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\t:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\u:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\y:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\z:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\q:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\s:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\y:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\j:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\k:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\k:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\n:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\c:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\e:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\u:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\f:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\g:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\j:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\o:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\v:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\r:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\t:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\v:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\h:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\i:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\l:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\m:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\z:\Desktop.ini 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\k: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\q: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\r: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\u: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\e: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\j: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\l: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\p: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\z: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\g: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\n: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\o: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\s: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\w: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\x: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\y: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\f: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\m: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\t: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\v: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened (read-only) \??\h: 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Drops autorun.inf file 1 TTPs 47 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created \??\p:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\t:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\v:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\w:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\z:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\g:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\i:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\m:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\r:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\z:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\g:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\m:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\u:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\v:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\w:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\y:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\c:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\l:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\n:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\o:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\q:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\t:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\u:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\y:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\j:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\j:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\e:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\i:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\k:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\k:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\l:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\x:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\e:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\q:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\s:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\o:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\c:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\f:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\f:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\h:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\h:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\n:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification \??\p:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created C:\Documents and Settings\Admin\Application Data\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\s:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\x:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created \??\r:\Autorun.inf 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\msvbvm60.dll 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File created C:\Windows\SysWOW64\uepnq.exe 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe File opened for modification C:\Windows\SysWOW64\uepnq.exe 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Negeri Serumpun Sebalai .pif .bat .com .scr .exe 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies Control Panel 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60" 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR" 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Modifies registry class 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image" 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document" 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1528 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe 1528 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe 1528 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe 1528 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe 1528 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe 1528 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe 1528 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe 1528 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1528 5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe"C:\Users\Admin\AppData\Local\Temp\5f54dc65bc765bc466c857f848339d05f3acb39bf469eecbf78f6f26b6453dc8.exe"1⤵
- Modifies system executable filetype association
- Modifies visibility of file extensions in Explorer
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1528