Analysis
-
max time kernel
127s -
max time network
43s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 04:17
Static task
static1
Behavioral task
behavioral1
Sample
KInstallTool.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
KInstallTool.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
KInstallTool.exe
-
Size
1.8MB
-
MD5
763d17d713bc627fc91dac155b531590
-
SHA1
08540b1812c891618dc5aa2597c57ff18deaab6a
-
SHA256
8bc74eec04dbe27c2facf483b55c5b9c2c862e5a5bbf76013523fc23f36abb0d
-
SHA512
854fcbfa9de1a5ac70f40c9ed131b3bf4e5b07fa6f9f2d07c8881f5ecf86e7c0c482667bd696de1dcf2b5ef469ff53f95ce80823723f18956ffdaee3eb21dbc2
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
KInstallTool.exedescription ioc process File opened for modification \??\PhysicalDrive0 KInstallTool.exe -
Modifies registry class 11 IoCs
Processes:
KInstallTool.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID KInstallTool.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories KInstallTool.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\did = "C50200ED7C10825509E9A464C182D68C" KInstallTool.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories\{6BC04964-67B7-4d50-BB9B-3653A5C305B3} KInstallTool.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node KInstallTool.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D} KInstallTool.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories\{6BC04964-67B7-4d50-BB9B-3653A5C305B3}\idex = "f50ca177944377c505bbc68aa6608dc9" KInstallTool.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories\{6BC04964-67B7-4d50-BB9B-3653A5C305B3}\idno = "1" KInstallTool.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E} KInstallTool.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278} KInstallTool.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories KInstallTool.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
KInstallTool.exepid process 1724 KInstallTool.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
KInstallTool.exepid process 1724 KInstallTool.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
KInstallTool.exepid process 1724 KInstallTool.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\KInstallTool.exe"C:\Users\Admin\AppData\Local\Temp\KInstallTool.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage