Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 15:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
040683f0a3ee62f04d1f3d230b5012af.exe
Resource
win7-20231215-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
040683f0a3ee62f04d1f3d230b5012af.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
040683f0a3ee62f04d1f3d230b5012af.exe
-
Size
747KB
-
MD5
040683f0a3ee62f04d1f3d230b5012af
-
SHA1
ab0e039ae600b910763dd542843125f11d6c20a5
-
SHA256
33fc2fd4d85b1d04c8ba5307a4ebe46aa8088fd4d60c4005d11b7833b0f717e6
-
SHA512
ff292abe736d20b2486baf3a3f9ebf87a07c89665dcb985fd0e674b1884d74c62f990262fc3491569d40bee7acd1f7e48fbd06de446706246f326f3638a89df1
-
SSDEEP
12288:xCTPgrnZiJiAaMVkUet7EwBI+APu4UjCFmZcZlyNGUO:xCTPMAzVkUetVI5u4+CFmZu4PO
Score
10/10
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 040683f0a3ee62f04d1f3d230b5012af.exe -
Disables use of System Restore points 1 TTPs
-
Executes dropped EXE 1 IoCs
pid Process 2712 inf4D2.tmp -
Loads dropped DLL 2 IoCs
pid Process 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" 040683f0a3ee62f04d1f3d230b5012af.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ytic = "eddl.exe" 040683f0a3ee62f04d1f3d230b5012af.exe -
Drops desktop.ini file(s) 48 IoCs
description ioc Process File created \??\c:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\h:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\j:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\p:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\g:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\i:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\o:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\y:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\z:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\x:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\k:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\n:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\o:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\s:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\t:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\u:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\s:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\t:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\h:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\l:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\m:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\m:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\n:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\q:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\v:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\x:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\z:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\g:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\p:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\u:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\w:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\c:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\e:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\f:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\r:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\v:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\e:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\i:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\r:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\w:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\y:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\q:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\f:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\j:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\k:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\l:\Desktop.ini 040683f0a3ee62f04d1f3d230b5012af.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\u: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\v: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\w: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\e: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\g: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\h: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\l: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\y: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\p: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\x: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\i: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\j: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\n: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\o: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\k: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\m: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\r: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\q: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\t: 040683f0a3ee62f04d1f3d230b5012af.exe File opened (read-only) \??\z: 040683f0a3ee62f04d1f3d230b5012af.exe -
Drops autorun.inf file 1 TTPs 47 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\e:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\g:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\l:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\o:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\q:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\h:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\r:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\z:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\z:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\r:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\s:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\g:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\i:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\m:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\m:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\n:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\n:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\x:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\c:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\h:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\j:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\k:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\o:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\w:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\u:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\f:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\i:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\k:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\p:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\s:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\u:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\c:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\e:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\j:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\q:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\v:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\v:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\y:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\p:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\t:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\t:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\w:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification \??\x:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\y:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created C:\Documents and Settings\Admin\Application Data\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\f:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe File created \??\l:\Autorun.inf 040683f0a3ee62f04d1f3d230b5012af.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\msvbvm60.dll 040683f0a3ee62f04d1f3d230b5012af.exe File created C:\Windows\SysWOW64\eddl.exe 040683f0a3ee62f04d1f3d230b5012af.exe File opened for modification C:\Windows\SysWOW64\eddl.exe 040683f0a3ee62f04d1f3d230b5012af.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Negeri Serumpun Sebalai .pif .bat .com .scr .exe 040683f0a3ee62f04d1f3d230b5012af.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2540 2288 WerFault.exe 27 -
Modifies Control Panel 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR" 040683f0a3ee62f04d1f3d230b5012af.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 040683f0a3ee62f04d1f3d230b5012af.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60" 040683f0a3ee62f04d1f3d230b5012af.exe -
Modifies registry class 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image" 040683f0a3ee62f04d1f3d230b5012af.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image" 040683f0a3ee62f04d1f3d230b5012af.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document" 040683f0a3ee62f04d1f3d230b5012af.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe 2288 040683f0a3ee62f04d1f3d230b5012af.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2712 2288 040683f0a3ee62f04d1f3d230b5012af.exe 28 PID 2288 wrote to memory of 2712 2288 040683f0a3ee62f04d1f3d230b5012af.exe 28 PID 2288 wrote to memory of 2712 2288 040683f0a3ee62f04d1f3d230b5012af.exe 28 PID 2288 wrote to memory of 2712 2288 040683f0a3ee62f04d1f3d230b5012af.exe 28 PID 2288 wrote to memory of 2540 2288 040683f0a3ee62f04d1f3d230b5012af.exe 31 PID 2288 wrote to memory of 2540 2288 040683f0a3ee62f04d1f3d230b5012af.exe 31 PID 2288 wrote to memory of 2540 2288 040683f0a3ee62f04d1f3d230b5012af.exe 31 PID 2288 wrote to memory of 2540 2288 040683f0a3ee62f04d1f3d230b5012af.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\040683f0a3ee62f04d1f3d230b5012af.exe"C:\Users\Admin\AppData\Local\Temp\040683f0a3ee62f04d1f3d230b5012af.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\inf4D2.tmpC:\Users\Admin\AppData\Local\Temp\inf4D2.tmp2⤵
- Executes dropped EXE
PID:2712
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 4602⤵
- Program crash
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
747KB
MD5040683f0a3ee62f04d1f3d230b5012af
SHA1ab0e039ae600b910763dd542843125f11d6c20a5
SHA25633fc2fd4d85b1d04c8ba5307a4ebe46aa8088fd4d60c4005d11b7833b0f717e6
SHA512ff292abe736d20b2486baf3a3f9ebf87a07c89665dcb985fd0e674b1884d74c62f990262fc3491569d40bee7acd1f7e48fbd06de446706246f326f3638a89df1
-
Filesize
335KB
MD5046552763e4167a93e63a50c018b7e61
SHA1f16ad0d96178c672dbb0b066cb35b89b30d35c03
SHA256e47c298cb6e28f1bd428d98889c0e19f645b57aeff1913b0622e5da6ae723807
SHA512098d5e88fd870bdcd7e77396f8e95048529f4c3eb2cea34b7633d1e7f51c4a7560685834f7270cc6eb4eaa5a2965b87024213d9dc24623abcdeeca747ed5847b
-
Filesize
216KB
MD5caf392dfbb92edb7ce12d6e3fcf25433
SHA1dfeac6709d01c312893851074898440c6fe2832f
SHA256cb85304bd6bd360472b07c9a84be4a0b2f1b3f8e4fa41bc0bad1ff00a6690536
SHA512e348f11addb84826b2c2f460ae1ef3542cca2db50e71546e7362f05d82118f8510e874a091d9b0a58cd37897be446f12f08fbad53f63e0b7a3034b2eca37f060
-
Filesize
97B
MD5e0b7531a87635a0a11dbd9edc02c7bed
SHA174a50849add50351da332164cbf0ae74a43ce8fe
SHA25620e16cf8b48b2bf3adc59251e7dc293c39eb87922d267a768a403fb76f13d765
SHA512e6cbf6e11ad29d17c219ca44ebbcb43adb76bef3d688f38e43520faded492caff162e249bd477f5441858a26eb567c3f70be3cf3cc181a2fb62aaae4efd23c67
-
Filesize
212B
MD5ca815edf2e481dd83bd0cff16caaf7a7
SHA1523fa767fac1b4061762c0262d4bc09a1fa7dddf
SHA256f2566afa47cadf4017f82ee80f11355989fd722fbbbbed1954392bbe2aa2b352
SHA512cef1cf04432326393cd700b6c9c4d3d816a61505a3ba99bafc935ffd52a78635130a752d091dd6511d9781ac9458a404bcfc69ca0cdec55da418b3b8bf9dace2
-
Filesize
631B
MD55313060d847a33c356e4e8e286e3de73
SHA1d2b5e89f1fbb96895371e1cde7997ff76814ea9e
SHA256ee482ee2540efc03f1cba611170096f68e14fd4d39bdc8650f3ef6900799fafc
SHA5128c90a8fd5372dadfe95df1deb07bbd14355620dd067b2cce58f76230e2f99129daf65ddc056cab0902ab2b70a4b838a484f62f37b0436e21a963dd1156f551b0
-
Filesize
380KB
MD56d778e0f95447e6546553eeea709d03c
SHA1811a005cf787c6ccbe0d9f1c36c1d49a9cb71fd1
SHA25662abed7d45040381bbced97ea7b6c697b418448fd3322fd4bfb2bbfdb6155eb4
SHA512a9401d8b077a48c0b6dd3443e62703d53513208f49d7b44d14f722f4c5400ffaca59582ca066d92d68a72aa96278bed1b2c5d8f1b85d5ef964d06e979a9ac09f
-
Filesize
297KB
MD5d6692df1ecb01e09ca9d9530d8f91054
SHA137bab036534b5bbaedb87298eadd4b848e64ebc7
SHA256c644f3f6d5aa92c87852510c80a37b06d18c8c8cf0ab1d415ceb7a2f7585321a
SHA51256f404a5dbffd6befee9944875cbb17b83631421b03f0c2812b32e6d16a0a4906efab4de629fc0c11b6a2ee840c07212130792ce075d6cfdf54786540fd66dde