33fc2fd4d85b1d04c8ba5307a4ebe46aa8088fd4d60c4005d11b7833b0f717e6

Analysis

max time kernel
184s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2023 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

040683f0a3ee62f04d1f3d230b5012af.exe
Size

747KB
MD5

040683f0a3ee62f04d1f3d230b5012af
SHA1

ab0e039ae600b910763dd542843125f11d6c20a5
SHA256

33fc2fd4d85b1d04c8ba5307a4ebe46aa8088fd4d60c4005d11b7833b0f717e6
SHA512

ff292abe736d20b2486baf3a3f9ebf87a07c89665dcb985fd0e674b1884d74c62f990262fc3491569d40bee7acd1f7e48fbd06de446706246f326f3638a89df1
SSDEEP

12288:xCTPgrnZiJiAaMVkUet7EwBI+APu4UjCFmZcZlyNGUO:xCTPMAzVkUetVI5u4+CFmZu4PO

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	040683f0a3ee62f04d1f3d230b5012af.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 1 IoCs

pid	Process
4944	inf4D2.tmp

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	040683f0a3ee62f04d1f3d230b5012af.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\leuqrfi = "pvgwhrb.exe"	040683f0a3ee62f04d1f3d230b5012af.exe

Drops desktop.ini file(s) 48 IoCs

description	ioc	Process
File created	\??\g:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\n:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\o:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\t:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\f:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\j:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\l:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\v:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\y:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\c:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\e:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\f:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\l:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\s:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\z:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\k:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\o:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\q:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\v:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\w:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\w:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\n:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\u:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\z:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\e:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\i:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\i:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\m:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\r:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\t:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\p:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\q:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	C:\Documents and Settings\Admin\Application Data\Mr_CF\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\h:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\j:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\k:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\m:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\p:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\x:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\x:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\c:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\g:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\h:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\r:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\s:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\u:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\y:\Desktop.ini	040683f0a3ee62f04d1f3d230b5012af.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\g:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\m:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\p:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\y:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\z:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\h:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\j:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\l:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\u:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\v:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\w:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\e:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\o:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\t:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\q:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\s:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\x:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\i:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\k:	040683f0a3ee62f04d1f3d230b5012af.exe
File opened (read-only)	\??\n:	040683f0a3ee62f04d1f3d230b5012af.exe

Drops autorun.inf file 1 TTPs 47 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\p:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\q:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\v:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\w:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	C:\Documents and Settings\Admin\Application Data\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\c:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\f:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\w:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\x:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\x:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\y:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\c:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\l:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\u:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\o:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\p:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\z:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\f:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\h:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\m:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\u:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\z:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\k:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\m:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\t:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\j:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\k:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\r:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\s:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\g:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\h:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\i:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\e:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\j:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\y:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\l:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\o:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\q:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\t:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\v:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\e:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\g:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\i:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\s:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File created	\??\n:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\n:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe
File opened for modification	\??\r:\Autorun.inf	040683f0a3ee62f04d1f3d230b5012af.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pvgwhrb.exe	040683f0a3ee62f04d1f3d230b5012af.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	040683f0a3ee62f04d1f3d230b5012af.exe
File created	C:\Windows\SysWOW64\pvgwhrb.exe	040683f0a3ee62f04d1f3d230b5012af.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Negeri Serumpun Sebalai .pif .bat .com .scr .exe	040683f0a3ee62f04d1f3d230b5012af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	3488	WerFault.exe	31

Modifies Control Panel 3 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\Desktop\ScreenSaveTimeOut = "60"	040683f0a3ee62f04d1f3d230b5012af.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\Desktop\SCRNSAVE.EXE = "MR_COO~1.SCR"	040683f0a3ee62f04d1f3d230b5012af.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	040683f0a3ee62f04d1f3d230b5012af.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "JPEG Image"	040683f0a3ee62f04d1f3d230b5012af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "JPEG Image"	040683f0a3ee62f04d1f3d230b5012af.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\ = "Princess Document"	040683f0a3ee62f04d1f3d230b5012af.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3488	040683f0a3ee62f04d1f3d230b5012af.exe
3488	040683f0a3ee62f04d1f3d230b5012af.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 4944	3488	040683f0a3ee62f04d1f3d230b5012af.exe	91
PID 3488 wrote to memory of 4944	3488	040683f0a3ee62f04d1f3d230b5012af.exe	91
PID 3488 wrote to memory of 4944	3488	040683f0a3ee62f04d1f3d230b5012af.exe	91

C:\Users\Admin\AppData\Local\Temp\040683f0a3ee62f04d1f3d230b5012af.exe
"C:\Users\Admin\AppData\Local\Temp\040683f0a3ee62f04d1f3d230b5012af.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies system executable filetype association
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
  C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 584
  2⤵
  - Program crash
  PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3488 -ip 3488
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Autorun.inf

Filesize
97B

MD5
e0b7531a87635a0a11dbd9edc02c7bed

SHA1
74a50849add50351da332164cbf0ae74a43ce8fe

SHA256
20e16cf8b48b2bf3adc59251e7dc293c39eb87922d267a768a403fb76f13d765

SHA512
e6cbf6e11ad29d17c219ca44ebbcb43adb76bef3d688f38e43520faded492caff162e249bd477f5441858a26eb567c3f70be3cf3cc181a2fb62aaae4efd23c67

Download Submit
C:\Desktop.ini

Filesize
212B

MD5
ca815edf2e481dd83bd0cff16caaf7a7

SHA1
523fa767fac1b4061762c0262d4bc09a1fa7dddf

SHA256
f2566afa47cadf4017f82ee80f11355989fd722fbbbbed1954392bbe2aa2b352

SHA512
cef1cf04432326393cd700b6c9c4d3d816a61505a3ba99bafc935ffd52a78635130a752d091dd6511d9781ac9458a404bcfc69ca0cdec55da418b3b8bf9dace2

Download Submit
C:\Folder.htt

Filesize
631B

MD5
5313060d847a33c356e4e8e286e3de73

SHA1
d2b5e89f1fbb96895371e1cde7997ff76814ea9e

SHA256
ee482ee2540efc03f1cba611170096f68e14fd4d39bdc8650f3ef6900799fafc

SHA512
8c90a8fd5372dadfe95df1deb07bbd14355620dd067b2cce58f76230e2f99129daf65ddc056cab0902ab2b70a4b838a484f62f37b0436e21a963dd1156f551b0

Download Submit
C:\Mr_CoolFace.scr

Filesize
747KB

MD5
040683f0a3ee62f04d1f3d230b5012af

SHA1
ab0e039ae600b910763dd542843125f11d6c20a5

SHA256
33fc2fd4d85b1d04c8ba5307a4ebe46aa8088fd4d60c4005d11b7833b0f717e6

SHA512
ff292abe736d20b2486baf3a3f9ebf87a07c89665dcb985fd0e674b1884d74c62f990262fc3491569d40bee7acd1f7e48fbd06de446706246f326f3638a89df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\inf4D2.tmp

Filesize
380KB

MD5
6d778e0f95447e6546553eeea709d03c

SHA1
811a005cf787c6ccbe0d9f1c36c1d49a9cb71fd1

SHA256
62abed7d45040381bbced97ea7b6c697b418448fd3322fd4bfb2bbfdb6155eb4

SHA512
a9401d8b077a48c0b6dd3443e62703d53513208f49d7b44d14f722f4c5400ffaca59582ca066d92d68a72aa96278bed1b2c5d8f1b85d5ef964d06e979a9ac09f

Download Submit
memory/3488-152-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3488-173-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download