Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2023 23:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41d252b23b8cbf3a68e88f4fde81edd1.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
41d252b23b8cbf3a68e88f4fde81edd1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
41d252b23b8cbf3a68e88f4fde81edd1.exe
-
Size
132KB
-
MD5
41d252b23b8cbf3a68e88f4fde81edd1
-
SHA1
72d95fb479adaa8697fcdce251ab6b1c51ac6dd7
-
SHA256
5b39ca0f6f3ba545394ad3e11e00ab3724659cfb5a4dcd37a16bc18bc2c5d93c
-
SHA512
796508e3df59e9aa7d633671977e458677dec0cb438d886cde1b1ba36cec17ba0246e54810b8030a5c0dcb0ad84d999900cd99378911661e4d71eb567a0f5f8b
-
SSDEEP
1536:vwWmIgYu9+7gWbrimfWSeJFzkRcTwdEQdIumgDL0FfxTGWpip5UhHR:vwlT8gWi2eJFzkRswUumgDLOfbiHWHR
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 41d252b23b8cbf3a68e88f4fde81edd1.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kjfeg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 41d252b23b8cbf3a68e88f4fde81edd1.exe -
Executes dropped EXE 1 IoCs
pid Process 3776 kjfeg.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /Z" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /e" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /h" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /I" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /L" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /p" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /V" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /c" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /d" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /N" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /v" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /S" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /O" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /t" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /b" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /C" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /U" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /j" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /f" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /u" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /o" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /l" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /Q" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /G" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /J" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /w" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /W" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /a" 41d252b23b8cbf3a68e88f4fde81edd1.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /F" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /T" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /Y" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /M" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /y" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /k" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /g" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /B" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /r" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /A" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /X" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /D" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /R" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /K" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /s" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /a" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /x" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /E" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /H" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /P" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /i" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /n" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /z" kjfeg.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kjfeg = "C:\\Users\\Admin\\kjfeg.exe /m" kjfeg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4612 41d252b23b8cbf3a68e88f4fde81edd1.exe 4612 41d252b23b8cbf3a68e88f4fde81edd1.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe 3776 kjfeg.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4612 41d252b23b8cbf3a68e88f4fde81edd1.exe 3776 kjfeg.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4612 wrote to memory of 3776 4612 41d252b23b8cbf3a68e88f4fde81edd1.exe 91 PID 4612 wrote to memory of 3776 4612 41d252b23b8cbf3a68e88f4fde81edd1.exe 91 PID 4612 wrote to memory of 3776 4612 41d252b23b8cbf3a68e88f4fde81edd1.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\41d252b23b8cbf3a68e88f4fde81edd1.exe"C:\Users\Admin\AppData\Local\Temp\41d252b23b8cbf3a68e88f4fde81edd1.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\kjfeg.exe"C:\Users\Admin\kjfeg.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD5930e2cd2207fe6a2ba127ad6a3ad4f86
SHA13668bc3ae7a8993bacb7f9d958f28a6814be1635
SHA256e947df9c7f4d86704090f7c3f12d34f33d5e637cbd18a99f0e56da3ad842f570
SHA512dcb252126324b8d1b57a7d340bc64cde6099c815bbd6d467487d79855906df04c0e865b6cd588b9e6280cdb8aed0022b66b1ce2470bb246461878e6dce6109ad