Overview

overview

10

Static

static

e787844eb3...09.exe

windows7_x64

10

e787844eb3...09.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20-05-2022 03:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609.exe

  • Size

    1.6MB

  • MD5

    be0f8e6d545ddc8c2cfedb76ad965a19

  • SHA1

    37fbc96b83ad23e9d8102351c18944e58450f927

  • SHA256

    e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609

  • SHA512

    cb7619971f232c4976b8cdd8cb3116a981e1b5433a87fffdda74880e6b29f9d7fc32bc1f30bb425ee000af6a48cc982ede2e693976631cd4fc989daa048c3589

Score
10/10
bootkitdiscoveryevasionpersistencesuricatatrojanupx

Malware Config

Signatures

  • suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

    suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

    suricata
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 35 IoCs
  • Sets file execution options in registry 2 TTPs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609.exe
    "C:\Users\Admin\AppData\Local\Temp\e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Program Files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys
    Filesize

    49KB

    MD5

    44a332318c9a823b85d1f5257dcc7ad9

    SHA1

    80a6e8cbd957f5280cdc69d4b1a441aba6bc6bf6

    SHA256

    ca615ede1d1356ac566189d4ba553f77ea074c4acb53d60b6f3144c8bfadde0c

    SHA512

    50b733732188c4ec42684fde06e9fc266d41c51c0009935c2fa9a301d80256122e9cab08e5b765e9270aa96138870c0881548cabd8891e42baadcbe416194c20

    Download Submit
  • \Program Files (x86)\kingsoft\kingsoft antivirus\security\kavbootc.sys
    Filesize

    49KB

    MD5

    44a332318c9a823b85d1f5257dcc7ad9

    SHA1

    80a6e8cbd957f5280cdc69d4b1a441aba6bc6bf6

    SHA256

    ca615ede1d1356ac566189d4ba553f77ea074c4acb53d60b6f3144c8bfadde0c

    SHA512

    50b733732188c4ec42684fde06e9fc266d41c51c0009935c2fa9a301d80256122e9cab08e5b765e9270aa96138870c0881548cabd8891e42baadcbe416194c20

    Download Submit
  • \Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys
    Filesize

    243KB

    MD5

    a6da3b519c6b7e3e7f8bd8e03dd19395

    SHA1

    e1ee69084db5c7b4ab9da6d035ab4439574218ff

    SHA256

    1940eddc40e5511f955f4f093d272b57ace997a6d95e02346a9772b4f2dbfa03

    SHA512

    a3430c964dd50acbb8572789d7a4fba3ad74dba4e8c8dcac139483e51ddf7a1fef3c8997bd68349c53d37b12fc9b0156c8d605fc1de73cbd33221e3589d6bad6

    Download Submit
  • \Program Files (x86)\kingsoft\kingsoft antivirus\security\ksde\kisknl.sys
    Filesize

    243KB

    MD5

    a6da3b519c6b7e3e7f8bd8e03dd19395

    SHA1

    e1ee69084db5c7b4ab9da6d035ab4439574218ff

    SHA256

    1940eddc40e5511f955f4f093d272b57ace997a6d95e02346a9772b4f2dbfa03

    SHA512

    a3430c964dd50acbb8572789d7a4fba3ad74dba4e8c8dcac139483e51ddf7a1fef3c8997bd68349c53d37b12fc9b0156c8d605fc1de73cbd33221e3589d6bad6

    Download Submit
  • \Users\Admin\AppData\Local\Temp\kdb_semrjgj.dll
    Filesize

    92.1MB

    MD5

    0d95bc52e08ff367d76f03fa00c15e0e

    SHA1

    9ca670e9e33ae58f74afcf5fa0eec81a317a6e81

    SHA256

    70b96250bfceb83b811dcfa7446161b17f668468695dea8a1ec58f62df421e17

    SHA512

    71b79757889ecf19d5cd8e20b13c2770077ba99d4ee3fa0deeb93856f8f7c09ed0d33e34190351d838e39e4652592d3e265bfdd799d09e0001836086109aa8cf

    Download Submit
  • memory/1668-54-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
    Filesize

    8KB

    Download