8bc74eec04dbe27c2facf483b55c5b9c2c862e5a5bbf76013523fc23f36abb0d

Resubmissions

29-07-2021 12:22

210729-9c739yrckx 10

27-07-2021 04:17

210727-dlhj2e4q6a 6

Analysis

max time kernel
116s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
27-07-2021 04:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KInstallTool.exe
Size

1.8MB
MD5

763d17d713bc627fc91dac155b531590
SHA1

08540b1812c891618dc5aa2597c57ff18deaab6a
SHA256

8bc74eec04dbe27c2facf483b55c5b9c2c862e5a5bbf76013523fc23f36abb0d
SHA512

854fcbfa9de1a5ac70f40c9ed131b3bf4e5b07fa6f9f2d07c8881f5ecf86e7c0c482667bd696de1dcf2b5ef469ff53f95ce80823723f18956ffdaee3eb21dbc2

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

KInstallTool.exe

description ioc process

File opened for modification \??\PhysicalDrive0 KInstallTool.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	KInstallTool.exe

Modifies registry class 11 IoCs

Processes:

KInstallTool.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\did = "495E371108B533E839323EE5728F0815"	KInstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories\{6BC04964-67B7-4d50-BB9B-3653A5C305B3}	KInstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	KInstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}	KInstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories	KInstallTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories\{6BC04964-67B7-4d50-BB9B-3653A5C305B3}\idno = "1"	KInstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}	KInstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	KInstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}	KInstallTool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories	KInstallTool.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8AB9CCC4-75EC-438b-B6C0-D8D78882A12D}\Implemented Categories\{6BC04964-67B7-4d50-BB9B-3653A5C305B3}\idex = "c4ab873b215d3a5ed815910edb5ebfd4"	KInstallTool.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

KInstallTool.exe

pid process

632 KInstallTool.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

KInstallTool.exe

pid process

632 KInstallTool.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

KInstallTool.exe

pid process

632 KInstallTool.exe

pid	process
632	KInstallTool.exe

pid	process
632	KInstallTool.exe

pid	process
632	KInstallTool.exe

C:\Users\Admin\AppData\Local\Temp\KInstallTool.exe
"C:\Users\Admin\AppData\Local\Temp\KInstallTool.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/632-114-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download