d8cea078199dbdef51ec7189cf03541bbcbd10c49a133b187348e2a24fe1e2eb

Analysis

max time kernel
76s
max time network
111s
platform
windows10_x64
resource
win10v200722
submitted
31/08/2020, 06:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KKKKK.exe
Size 1001KB
Sample200831-fehs159y6j
SHA256 d8cea078199dbdef51ec7189cf03541bbcbd10c49a133b187348e2a24fe1e2eb
MD5 8fd5cc075d71bcc33cf6e7d6ce4c9afb
SHA1 35667d2f6aa4f06ad2e0de80cb2b54424671cb0d
SHA512 5372258819ea731fbb624b151416bbc6f9e197d03b15a6dd5fc8bdcefd7c8f40e9fe7dd6a0853b86da81aed861358427ab5e97b1a1494520b07712405a9a5f49
MD5 SHA1 SHA512

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3824-2-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral2/memory/3824-2-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral2/memory/3824-4-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral2/memory/3824-4-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral2/memory/3824-5-0x0000000000400000-0x000000000051E000-memory.dmp	upx
behavioral2/memory/3824-5-0x0000000000400000-0x000000000051E000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
3080	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KKKKKKK.vbs	notepad.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3288 set thread context of 3824	3288	KKKKK.exe	75

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = c76b07656c7fd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3288	KKKKK.exe
3288	KKKKK.exe
3824	KKKKK.exe
3824	KKKKK.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3288	KKKKK.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	636	svchost.exe
Token: SeCreatePagefilePrivilege	636	svchost.exe
Token: SeDebugPrivilege	3824	KKKKK.exe
Token: SeDebugPrivilege	3080	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 2068	3288	KKKKK.exe	74
PID 3288 wrote to memory of 2068	3288	KKKKK.exe	74
PID 3288 wrote to memory of 2068	3288	KKKKK.exe	74
PID 3288 wrote to memory of 2068	3288	KKKKK.exe	74
PID 3288 wrote to memory of 2068	3288	KKKKK.exe	74
PID 3288 wrote to memory of 3824	3288	KKKKK.exe	75
PID 3288 wrote to memory of 3824	3288	KKKKK.exe	75
PID 3288 wrote to memory of 3824	3288	KKKKK.exe	75
PID 3824 wrote to memory of 3080	3824	KKKKK.exe	78
PID 3824 wrote to memory of 3080	3824	KKKKK.exe	78
PID 3824 wrote to memory of 3080	3824	KKKKK.exe	78

C:\Users\Admin\AppData\Local\Temp\KKKKK.exe
"C:\Users\Admin\AppData\Local\Temp\KKKKK.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  - Drops startup file
  PID:2068
- C:\Users\Admin\AppData\Local\Temp\KKKKK.exe
  "C:\Users\Admin\AppData\Local\Temp\KKKKK.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\KKKKK.exe'
    3⤵
    - Deletes itself
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3080-21-0x0000000007B50000-0x0000000007B51000-memory.dmp

Download

memory/3080-23-0x00000000082B0000-0x00000000082B1000-memory.dmp

Download

memory/3080-28-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Download

memory/3080-27-0x00000000093A0000-0x00000000093A1000-memory.dmp

Download

memory/3080-26-0x0000000008F20000-0x0000000008F21000-memory.dmp

Download

memory/3080-16-0x00000000012A0000-0x00000000012A1000-memory.dmp

Download

memory/3080-24-0x0000000008190000-0x0000000008191000-memory.dmp

Download

memory/3080-17-0x0000000007340000-0x0000000007341000-memory.dmp

Download

memory/3080-22-0x0000000007320000-0x0000000007321000-memory.dmp

Download

memory/3080-19-0x0000000007A70000-0x0000000007A71000-memory.dmp

Download

memory/3080-18-0x0000000007170000-0x0000000007171000-memory.dmp

Download

memory/3080-15-0x00000000739D0000-0x00000000740BE000-memory.dmp

Download

memory/3080-25-0x0000000009980000-0x0000000009981000-memory.dmp

Download

memory/3288-0-0x0000000000400000-0x0000000000501000-memory.dmp

Download

memory/3824-2-0x0000000000400000-0x000000000051E000-memory.dmp

Download

memory/3824-13-0x0000000002960000-0x0000000002961000-memory.dmp

Download

memory/3824-12-0x0000000004EC0000-0x0000000004EC1000-memory.dmp

Download

memory/3824-11-0x0000000002450000-0x0000000002451000-memory.dmp

Download

memory/3824-8-0x0000000073460000-0x0000000073B4E000-memory.dmp

Download

memory/3824-7-0x0000000002342000-0x0000000002343000-memory.dmp

Download

memory/3824-6-0x0000000002350000-0x00000000023D6000-memory.dmp

Download

memory/3824-5-0x0000000000400000-0x000000000051E000-memory.dmp

Download

memory/3824-4-0x0000000000400000-0x000000000051E000-memory.dmp

Download